Challenge 1: Writing a Fail-Safe SSLProtocol Line — Solution
Walkthrough

The line:

SSLProtocol -all +TLSv1.2 +TLSv1.3

Why this is the fail-safe form:

-all starts from a clean slate, disabling every protocol version Apache
knows about, including any legacy SSL versions and TLS 1.0/1.1. The
two +TLSv1.2 +TLSv1.3 entries then explicitly re-enable only those
two versions. A positive-only line like "SSLProtocol +TLSv1.2
+TLSv1.3" (no leading -all) doesn't actually guarantee older versions
are off -- it depends entirely on what Apache's own compiled-in
default protocol set already includes, which can vary by version and
distribution, and could quietly still allow an old, weak protocol
underneath. The -all-then-allow form removes that ambiguity: nothing
is enabled except what's explicitly listed, regardless of Apache's
own defaults, and it fails safe if a brand-new protocol version is
ever added to Apache's supported list in a future update -- it won't
be silently allowed just because it's new.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader reaches for the deny-then-allow
pattern specifically, not just any syntax that happens to name TLS 1.2
and 1.3 -- the distinction between the two forms is the actual point
of this chapter's own SSLProtocol section.