A Java application needs to securely generate a random number for a cryptographic nonce. The team is considering using java.util.Random, SecureRandom, or a custom algorithm. Which choice is most secure and why?

Use java.util.Random because it is faster and sufficient for nonces.

Use a constant nonce and rely on encryption to protect it.

Use SecureRandom because it is cryptographically secure and designed for this purpose.

Use a custom algorithm based on the current time and user ID.

A Java developer needs to sign a JWT token for authentication. They are considering using `MessageDigest` with MD5 to create a signature. Which library or API should they use instead?

Use `Mac` with HmacSHA256 and a securely stored key.

Use `Cipher` with AES-ECB to encrypt the token.

Use `MessageDigest` with SHA-1 and a static salt.

Use `SecureRandom` to generate a random string as the signature.

A penetration tester is assessing a Java application that uses RSA encryption. The tester wants to identify potential side-channel vulnerabilities. Which testing methods are appropriate for detecting side-channel leaks? (Select all that apply.)

Run a static analysis tool to look for constant-time comparison functions.

Send random ciphertexts and observe whether the application crashes.

Measure the response time of decryption operations for different ciphertexts.

Monitor CPU power consumption during decryption.

Review the source code for the use of `MessageDigest.isEqual` for MAC comparison.

EC-CouncilCertified Application Security Engineer (Java)

Domain 5Objective 3

Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 4)

Part of the Secure Coding: Cryptography domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 16–20

16expert · hard
A Java application uses a digital signature to verify the integrity of software updates. An attacker manages to replace a signed update with a malicious one, and the application accepts it because the signature verification uses a weak hash algorithm. Which security property has been violated?
Select an answer first
17expert · medium
A Java application needs to securely generate a random number for a cryptographic nonce. The team is considering using java.util.Random, SecureRandom, or a custom algorithm. Which choice is most secure and why?
Select an answer first
18foundation · easy
If an attacker successfully performs a padding oracle attack on a system using CBC-mode encryption, which security property is most directly compromised?
Select an answer first
19application · medium
A Java developer needs to sign a JWT token for authentication. They are considering using `MessageDigest` with MD5 to create a signature. Which library or API should they use instead?
Select an answer first
20expert · hard · select all that apply
A penetration tester is assessing a Java application that uses RSA encryption. The tester wants to identify potential side-channel vulnerabilities. Which testing methods are appropriate for detecting side-channel leaks? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 4)

Questions 16–20

A Java application uses a digital signature to verify the integrity of software updates. An attacker manages to replace a signed update with a malicious one, and the application accepts it because the signature verification uses a weak hash algorithm. Which security property has been violated?

A Java application needs to securely generate a random number for a cryptographic nonce. The team is considering using java.util.Random, SecureRandom, or a custom algorithm. Which choice is most secure and why?

If an attacker successfully performs a padding oracle attack on a system using CBC-mode encryption, which security property is most directly compromised?

A Java developer needs to sign a JWT token for authentication. They are considering using `MessageDigest` with MD5 to create a signature. Which library or API should they use instead?

A penetration tester is assessing a Java application that uses RSA encryption. The tester wants to identify potential side-channel vulnerabilities. Which testing methods are appropriate for detecting side-channel leaks? (Select all that apply.)

Keep studying — Secure Coding: Cryptography