What is a common sign of weak TLS configuration in a web app?

• A. Use of modern TLS versions and strong cipher suites.
• B. Use of outdated TLS versions, weak cipher suites, or missing security headers.
• C. TLS misconfig cannot be detected by scanners.
• D. TLS is always secure by default in all web apps.

Answer: (B)

Weak TLS configuration shows up when a web app, or its server, still supports outdated protocol versions, uses weak cipher suites, or omits important security headers. These signs mean data in transit can be more easily observed, altered, or redirected by an attacker. For example, older TLS versions (like 1.0/1.1) have known vulnerabilities; weak ciphers (such as those using RC4 or 3DES) are easily broken with modern hardware or downgrade tools; and missing headers like Strict-Transport-Security leave users vulnerable to downgrade and mixed-content attacks. Together, these issues create clear, actionable weaknesses that security scanners and auditors look for, making them the telltale signs of a weak TLS setup. In contrast, using modern TLS versions with strong cipher suites indicates a solid configuration, and claims that TLS misconfigurations cannot be detected or that TLS is always secure by default are inaccurate in practice.