Which misconfiguration refers to weak TLS settings on HTTPS?

• A. Directory listing enabled
• B. Insecure TLS/HTTPS misconfigurations (weak TLS settings)
• C. Default credentials
• D. Open admin interfaces

Answer: (B)

This question tests recognizing TLS/HTTPS misconfigurations, specifically weak TLS settings. Weak TLS settings happen when a server that serves HTTPS uses outdated protocols or weak cipher suites, or otherwise fails to implement modern protections (for example, allowing TLS 1.0/1.1, using weak ciphers, or missing proper certificate handling). Even though HTTPS is enabled, these weaknesses leave data vulnerable to interception or downgrade attacks, so identifying this as the misconfiguration aligns directly with the problem.

The other options describe different types of server misconfigurations that aren’t about the security of TLS/HTTPS settings themselves—for example, directory listing exposes file listings, default credentials relate to authentication weaknesses, and open admin interfaces refer to exposed management access. These do not specifically address weak TLS configurations, so they’re not the correct focus here.