A .NET application uses a custom encryption scheme that encrypts data with AES-CBC and then signs the ciphertext with HMAC-SHA256. The developer believes this provides both confidentiality and integrity. A security review recommends using AES-GCM instead. What is the main advantage of AES-GCM over the current scheme?

AES-GCM does not require an initialization vector.

AES-GCM combines encryption and authentication in a single algorithm, reducing the risk of misuse and providing both confidentiality and integrity.

AES-GCM uses a longer key than AES-CBC.

AES-GCM is faster than AES-CBC in all scenarios.

A .NET application uses AES-256-GCM for encrypting data. The application generates a new random key for each encryption and stores the key alongside the ciphertext. A security review flags this as a risk. What is the primary weakness, and what is the best solution?

The algorithm is weak; switch to AES-CBC

The IV is reused; generate a new IV for each encryption

The key is too short; use a 512-bit key

The key is not protected; store the key in a secure key management service

A .NET application uses a custom encryption routine that performs AES encryption and then applies a base64 encoding. The developer believes this provides extra security. A penetration tester finds that the application is vulnerable to a chosen-ciphertext attack. Which improvement should be made to the encryption design?

Add a second layer of encryption with a different algorithm.

Use a longer key, such as AES-512.

Use an authenticated encryption mode such as AES-GCM to ensure ciphertext integrity.

Apply base64 encoding twice before encryption.

A .NET application uses a custom password hashing function that is known to be fast. The application stores hashes in a database. Which countermeasure is most effective against brute-force attacks on the hashes?

Use a longer salt to make the hash longer

Encrypt the hashes with a strong key

Use a slow, adaptive hashing algorithm like PBKDF2 with a high iteration count

Use a faster hashing algorithm to reduce server load

A developer at a financial firm implemented AES-CBC encryption for sensitive data. The application returns a distinct error message when the padding is invalid. An attacker is using this behavior to decrypt data without the key. Which cryptographic attack is being performed, and what is the most effective mitigation?

Dictionary attack; require stronger passwords for the encryption key

Side-channel attack; add random delays to the error response

Padding oracle attack; use authenticated encryption such as AES-GCM or add a MAC with encrypt-then-MAC

Brute-force attack; increase the key size to 256 bits

EC-CouncilCertified Application Security Engineer (.NET)

Domain 5Objective 4

Cryptographic Attacks CASENET Practice Questions (Page 7)

Part of the Secure Coding: Cryptography domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

3concepts

Questions 31–35

31application · medium
A .NET application uses a custom encryption scheme that encrypts data with AES-CBC and then signs the ciphertext with HMAC-SHA256. The developer believes this provides both confidentiality and integrity. A security review recommends using AES-GCM instead. What is the main advantage of AES-GCM over the current scheme?
Select an answer first
32expert · hard
A .NET application uses AES-256-GCM for encrypting data. The application generates a new random key for each encryption and stores the key alongside the ciphertext. A security review flags this as a risk. What is the primary weakness, and what is the best solution?
Select an answer first
33application · medium
A .NET application uses a custom encryption routine that performs AES encryption and then applies a base64 encoding. The developer believes this provides extra security. A penetration tester finds that the application is vulnerable to a chosen-ciphertext attack. Which improvement should be made to the encryption design?
Select an answer first
34application · medium
A .NET application uses a custom password hashing function that is known to be fast. The application stores hashes in a database. Which countermeasure is most effective against brute-force attacks on the hashes?
Select an answer first
35application · medium
A developer at a financial firm implemented AES-CBC encryption for sensitive data. The application returns a distinct error message when the padding is invalid. An attacker is using this behavior to decrypt data without the key. Which cryptographic attack is being performed, and what is the most effective mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Cryptographic Attacks CASENET Practice Questions (Page 7)

Questions 31–35

A .NET application uses AES-256-GCM for encrypting data. The application generates a new random key for each encryption and stores the key alongside the ciphertext. A security review flags this as a risk. What is the primary weakness, and what is the best solution?

A .NET application uses a custom password hashing function that is known to be fast. The application stores hashes in a database. Which countermeasure is most effective against brute-force attacks on the hashes?

Keep studying — Secure Coding: Cryptography