Cryptanalysis and Attacks CEH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In which type of cryptanalytic attack does the attacker have access only to intercepted ciphertext?

   • AKnown-plaintext attack
   • BChosen-plaintext attack
   • CCiphertext-only attack
   • DChosen-ciphertext attack
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security auditor is evaluating a hardware security module (HSM) used for cryptographic operations. The auditor notices that the HSM's power consumption varies slightly depending on the secret key bits being processed. Which type of attack is the auditor concerned about?

   • AReplay attack by capturing and retransmitting power traces.
   • BBrute-force attack by trying all possible keys.
   • CSide-channel attack, specifically power analysis, to extract the secret key.
   • DDictionary attack using common key values.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A system administrator is concerned about the risk of rainbow table attacks on the company's password database. The database currently stores SHA-256 hashes without salt. Which mitigation is most effective against rainbow table attacks?

   • ASwitch from SHA-256 to MD5 to reduce hash computation time.
   • BUse a single static salt for all passwords.
   • CAdd a unique random salt to each password before hashing.
   • DStore passwords in plaintext to avoid hash computation.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security administrator is migrating a legacy system that stores passwords as unsalted MD5 hashes. The administrator wants to upgrade to a more secure scheme but must maintain compatibility with existing hashes. Which approach best balances security and compatibility?

   • AAdd a static salt to all existing MD5 hashes and re-hash them with MD5.
   • BImmediately replace all MD5 hashes with bcrypt hashes by re-hashing the existing MD5 hashes.
   • CStore passwords in plaintext to avoid the need for hashing.
   • DStore new passwords with a unique salt and a strong hash (e.g., bcrypt), and keep legacy MD5 hashes only for verification until users change their passwords.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which attack model requires the attacker to obtain the decryption of ciphertexts of their choosing?

   • AChosen-ciphertext attack
   • BRelated-key attack
   • CKnown-plaintext attack
   • DChosen-plaintext attack
   Reveal Solution Discussion Select an answer first