A security analyst notices that a user's authentication request is being replayed to gain unauthorized access. The system uses a simple challenge-response protocol without any freshness mechanism. Which countermeasure would be most effective to prevent this attack?

Use a longer encryption key for the authentication messages.

Switch from symmetric to asymmetric encryption.

Implement a rainbow table to store valid responses.

Add a nonce or timestamp to each authentication request and verify it on the server.

What is the birthday attack primarily used to find?

The encryption key in a block cipher

The plaintext from ciphertext using frequency analysis

A security architect is designing a digital signature system and must choose a hash function. The system will be used for many years, and the architect is concerned about collision resistance. Which hash function choice and additional measure would best mitigate the risk of a birthday attack?

Use MD5 and add a salt to each message before hashing.

Use a custom hash function with a 128-bit output to improve performance.

Use SHA-256 and ensure that the hash output is at least 256 bits, making a birthday attack require about 2^128 operations.

Use SHA-1 and truncate the output to 160 bits to save space.

What information does an attacker possess in a known-plaintext attack?

Pairs of plaintext and corresponding ciphertext

The ability to choose plaintexts to encrypt

The ability to choose ciphertexts to decrypt

EC-CouncilCertified Ethical Hacker

Domain 9Objective 3

Cryptanalysis and Attacks CEH Practice Questions (Page 5)

Part of the Cryptography domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)

63questions here

13free pages

16concepts

16 Concepts in This Objective

Cryptanalysis Fundamentals
Types of Cryptanalytic Attacks
Brute-Force Attack
Dictionary Attack
Rainbow Table Attack
Frequency Analysis
Known-Plaintext Attack
Chosen-Plaintext Attack
Chosen-Ciphertext Attack
Related-Key Attack
Side-Channel Attacks
Man-in-the-Middle Attack
Replay Attack
Birthday Attack
Meet-in-the-Middle Attack
Cryptanalytic Tools and Techniques

Questions 21–25

21application · medium
A security analyst notices that a user's authentication request is being replayed to gain unauthorized access. The system uses a simple challenge-response protocol without any freshness mechanism. Which countermeasure would be most effective to prevent this attack?
Select an answer first
22application · medium
A security researcher is analyzing a proprietary encryption algorithm used by a smart card. The researcher has physical access to the card and can input any data and observe the encrypted output. Which type of attack is the researcher performing?
Select an answer first
23foundation · easy
What is the birthday attack primarily used to find?
Select an answer first
24expert · hard
A security architect is designing a digital signature system and must choose a hash function. The system will be used for many years, and the architect is concerned about collision resistance. Which hash function choice and additional measure would best mitigate the risk of a birthday attack?
Select an answer first
25foundation · easy
What information does an attacker possess in a known-plaintext attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.