Your question is Investigate TLS Downgrade Attack. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Explain how you would investigate and remediate a suspected downgrade attack on a TLS-secured endpoint at Amazon.
Discuss how you would establish whether the downgrade occurred at the client, endpoint, load balancer, CDN, proxy, or network layer. Cover evidence collection, affected TLS versions and cipher suites, containment, configuration changes, validation, monitoring, and incident response. Name relevant AWS services and explain how each control mitigates a specific threat.
