A developer implements password hashing using MD5 with a static salt. A security review flags that the hashes are vulnerable to brute-force and rainbow-table attacks. Which replacement is the most secure choice?

Use a single iteration of SHA-512 with the username as salt.

Use PBKDF2 with a per-user random salt and a high iteration count.

Use AES-256 to encrypt the passwords with a static key.

Use SHA-256 with a global salt stored in the code.

A Java application uses the `javax.crypto` package to encrypt data. The developer wants to avoid implementation flaws and ensure the code is maintainable. Which practice is most aligned with using established cryptographic libraries correctly?

Use high-level abstractions like `AES/GCM/NoPadding` with a randomly generated IV.

Use `AES/ECB/NoPadding` for simplicity and performance.

Use the same IV for every encryption to simplify testing.

Implement a custom encryption algorithm to avoid library vulnerabilities.

Which Java API is the standard for cryptographic operations and provides a framework for using various algorithms?

Java Remote Method Invocation (RMI)

Java Naming and Directory Interface (JNDI)

Java Database Connectivity (JDBC)

Java Cryptography Architecture (JCA)

Why should cryptographic error messages be generic and not reveal specific details?

To make the application easier to debug for developers

To prevent attackers from gaining information that could be used to launch padding oracle or other attacks

To comply with user interface design standards

To improve the performance of the cryptographic operations

A Java application encrypts a database column using AES-ECB. An attacker who can insert data into the database notices that identical plaintext values produce identical ciphertexts. Which attack is the attacker most likely to perform?

Side-channel attack using timing differences.

Frequency analysis to infer the plaintext of encrypted values.

Brute-force attack on the key using a rainbow table.

Padding oracle attack to decrypt the entire database.

EC-CouncilCertified Application Security Engineer (Java)

Domain 5Objective 3

Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 7)

Part of the Secure Coding: Cryptography domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 31–35

31application · medium
A developer implements password hashing using MD5 with a static salt. A security review flags that the hashes are vulnerable to brute-force and rainbow-table attacks. Which replacement is the most secure choice?
Select an answer first
32application · medium
A Java application uses the `javax.crypto` package to encrypt data. The developer wants to avoid implementation flaws and ensure the code is maintainable. Which practice is most aligned with using established cryptographic libraries correctly?
Select an answer first
33foundation · easy
Which Java API is the standard for cryptographic operations and provides a framework for using various algorithms?
Select an answer first
34foundation · easy
Why should cryptographic error messages be generic and not reveal specific details?
Select an answer first
35application · medium
A Java application encrypts a database column using AES-ECB. An attacker who can insert data into the database notices that identical plaintext values produce identical ciphertexts. Which attack is the attacker most likely to perform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.