Get Your CertSecurity FundamentalsPlayCompete
‹ All Security Fundamentals questions

Security Fundamentals Practice Question 10: TLS Certificate Phishing

Security Fundamentals · Test 1 · question 10 of 10

Social Engineering & Trusthard

An employee receives an email saying his payroll account is locked, with a link to https://payroll-verify-portal.example. The page shows a valid HTTPS padlock with no browser warnings and asks for his corporate password. He reasons that the valid certificate means the site is legitimate. What does the valid certificate actually establish?

Select one answer
Show answer and explanation

Answer:

  • C. That the connection is encrypted to a server that proved control of the domain payroll-verify-portal.example, and nothing about who runs it or their intent

A TLS certificate binds a public key to a domain name. OWASP notes that all publicly issued certificates must be domain validated, and that free, browser-trusted domain-validated (DV) certificates are available. Anyone who registers a look-alike domain can get one within minutes, which is why phishing sites routinely show a padlock. The padlock means "your traffic to *this* domain is private and has not been tampered with in transit" (C). It does not tell you whether the domain is the one you meant to visit.

This is a classic phishing attack. NIST defines phishing as acquiring sensitive data through a fraudulent solicitation in which the perpetrator masquerades as a legitimate business. The warning signs are the urgent pretext and an unfamiliar domain, not the certificate. The right response is to go to the payroll system through a known bookmark and report the email.

- A is wrong because DV certificates involve no business vetting. OWASP also notes that browsers no longer show extended-validation status, and treat DV, OV, and EV certificates as effectively the same. - B is wrong because certificate validation checks the certificate chain and the name, not the content of the page. - D is wrong because certificate issuance has nothing to do with email sender records, and the domain in the stem clearly is not the company's.

References: OWASP Transport Layer Security Cheat Sheet; NIST CSRC Glossary: phishing

Practice Test 1 ›

Study guides for Security Fundamentals

AWS Security Specialty: is it worth it, and what's testedAWS Security Specialty (SCS-C03): who it's worth it for, the six domains, new question types, price, and how it compares with CISSP.
Best cloud security certification in 2026: which one firstCompare the top cloud security certifications for 2026, from AWS Security Specialty, SC-500 and Google PCSE to CKS and CCSP, and the order to take them.