Why is a chosen-ciphertext attack considered more powerful than a ciphertext-only attack?

Because it gives the attacker access to decryption results for chosen inputs

Because it works against all encryption algorithms

Because it requires less computational power

Because it does not require any ciphertext

What is the primary use of the tool 'Hashcat'?

To perform high-speed password recovery using GPU acceleration

To analyze network traffic for passwords

To exploit vulnerabilities in web applications

To scan for open ports on a target system

A penetration tester is attempting to crack a password hash that is known to be a 40-bit WEP key. The tester has a limited time window of 24 hours and access to a CPU cluster that can test 1 million keys per second. The tester also has a wordlist of common WEP keys. Which strategy is most likely to succeed within the time constraint?

Perform a brute-force attack over the entire 40-bit key space.

Use a rainbow table attack with precomputed tables for WEP keys.

Use a dictionary attack with the wordlist, then expand with rule-based mutations if needed.

Conduct a side-channel attack on the WEP implementation.

Which statement best distinguishes cryptography from cryptanalysis?

Cryptography creates secure systems; cryptanalysis evaluates their security.

Cryptography is older than cryptanalysis.

Cryptography is used only for encryption; cryptanalysis is used only for decryption.

Cryptography is a mathematical field; cryptanalysis is a computer science field.

An attacker captures a valid authentication message from a user logging into a web application. Later, the attacker retransmits the same message to the server and successfully authenticates as the user. Which countermeasure would be most effective to prevent this attack?

Include a nonce or timestamp in each authentication message and have the server reject duplicates or expired messages.

Use a hash function with a larger output size for the authentication digest.

Switch from HTTP to HTTPS for the authentication page.

Use a longer encryption key for the authentication protocol.

EC-CouncilCertified Ethical Hacker

Domain 9Objective 3

Cryptanalysis and Attacks CEH Practice Questions (Page 2)

Part of the Cryptography domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)

63questions here

13free pages

16concepts

16 Concepts in This Objective

Cryptanalysis Fundamentals
Types of Cryptanalytic Attacks
Brute-Force Attack
Dictionary Attack
Rainbow Table Attack
Frequency Analysis
Known-Plaintext Attack
Chosen-Plaintext Attack
Chosen-Ciphertext Attack
Related-Key Attack
Side-Channel Attacks
Man-in-the-Middle Attack
Replay Attack
Birthday Attack
Meet-in-the-Middle Attack
Cryptanalytic Tools and Techniques

Questions 6–10

6foundation · easy
Why is a chosen-ciphertext attack considered more powerful than a ciphertext-only attack?
Select an answer first
7foundation · easy
What is the primary use of the tool 'Hashcat'?
Select an answer first
8expert · hard
A penetration tester is attempting to crack a password hash that is known to be a 40-bit WEP key. The tester has a limited time window of 24 hours and access to a CPU cluster that can test 1 million keys per second. The tester also has a wordlist of common WEP keys. Which strategy is most likely to succeed within the time constraint?
Select an answer first
9foundation · easy
Which statement best distinguishes cryptography from cryptanalysis?
Select an answer first
10application · medium
An attacker captures a valid authentication message from a user logging into a web application. Later, the attacker retransmits the same message to the server and successfully authenticates as the user. Which countermeasure would be most effective to prevent this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.