A .NET web application stores user passwords using the SHA-256 hash with a static salt. A penetration test reveals that many users have the same password hash, and the tester quickly recovered several plaintext passwords. Which countermeasure should the security team implement first?

Encrypt the password hashes with AES-256 before storing them

Switch to a keyed hash such as HMAC-SHA256 with a per-user secret key

Add a second static salt to the existing SHA-256 hash

Use a per-user random salt and a slow, adaptive password hashing algorithm like PBKDF2 or bcrypt

A .NET web application stores user passwords using the Rfc2898DeriveBytes class with a 128-bit salt and 10,000 iterations. A security review notes that the application accepts passwords up to 128 characters and does not enforce any complexity requirements. An attacker obtains the password hash database. Which additional control would most directly mitigate the risk of a successful dictionary attack against the stored hashes?

Switch to SHA-512 for hashing and store the hash without a salt.

Use a random 64-bit salt and a single iteration of SHA-256.

Encrypt the password hashes with AES-256 using a hard-coded key in the application source code.

Increase the iteration count to 100,000 and enforce a minimum password length of 12 characters.

A .NET application generates RSA keys for digital signatures. The developer uses a 1024-bit key and stores the private key in a .pfx file protected by a weak password. A security auditor flags this as a cryptographic weakness. Which combination of changes should the developer implement?

Use the same RSA key pair for both encryption and signing.

Use a 1024-bit key but switch to SHA-512 for signing.

Keep the 1024-bit key but use a stronger password for the .pfx file.

Generate a 2048-bit or larger RSA key and store the private key in a hardware security module (HSM) or Azure Key Vault.

A .NET application uses the same IV for every encryption operation with AES-CBC. An attacker notices that identical plaintext blocks produce identical ciphertext blocks. Which weakness is being exploited, and what is the correct fix?

Improper key management; rotate the encryption key frequently

Flawed implementation; generate a random IV for each encryption operation

Side-channel attack; add random delays to the encryption process

EC-CouncilCertified Application Security Engineer (.NET)

Domain 5Objective 4

Cryptographic Attacks CASENET Practice Questions (Page 5)

Part of the Secure Coding: Cryptography domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

3concepts

Questions 21–25

21foundation · easy
A .NET application stores encryption keys in the source code and uses the same key for all users. Which cryptographic weakness does this represent?
Select an answer first
22application · medium
A .NET web application stores user passwords using the SHA-256 hash with a static salt. A penetration test reveals that many users have the same password hash, and the tester quickly recovered several plaintext passwords. Which countermeasure should the security team implement first?
Select an answer first
23application · medium
A .NET web application stores user passwords using the Rfc2898DeriveBytes class with a 128-bit salt and 10,000 iterations. A security review notes that the application accepts passwords up to 128 characters and does not enforce any complexity requirements. An attacker obtains the password hash database. Which additional control would most directly mitigate the risk of a successful dictionary attack against the stored hashes?
Select an answer first
24application · medium
A .NET application generates RSA keys for digital signatures. The developer uses a 1024-bit key and stores the private key in a .pfx file protected by a weak password. A security auditor flags this as a cryptographic weakness. Which combination of changes should the developer implement?
Select an answer first
25application · medium
A .NET application uses the same IV for every encryption operation with AES-CBC. An attacker notices that identical plaintext blocks produce identical ciphertext blocks. Which weakness is being exploited, and what is the correct fix?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Cryptographic Attacks CASENET Practice Questions (Page 5)

Questions 21–25

A .NET application stores encryption keys in the source code and uses the same key for all users. Which cryptographic weakness does this represent?

A .NET web application stores user passwords using the SHA-256 hash with a static salt. A penetration test reveals that many users have the same password hash, and the tester quickly recovered several plaintext passwords. Which countermeasure should the security team implement first?

A .NET application generates RSA keys for digital signatures. The developer uses a 1024-bit key and stores the private key in a .pfx file protected by a weak password. A security auditor flags this as a cryptographic weakness. Which combination of changes should the developer implement?

A .NET application uses the same IV for every encryption operation with AES-CBC. An attacker notices that identical plaintext blocks produce identical ciphertext blocks. Which weakness is being exploited, and what is the correct fix?

Keep studying — Secure Coding: Cryptography