Cryptanalysis and Attacks CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security consultant is reviewing a system that stores password hashes. The hashes are computed without salt. The consultant warns that an attacker could use precomputed hash chains to reverse the hashes quickly. Which countermeasure would be most effective to mitigate this risk?

   • AUse a longer password policy.
   • BUse a faster hash algorithm to improve performance.
   • CAdd a unique salt to each password before hashing.
   • DStore the hashes in a separate database.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security researcher is analyzing a block cipher used in a wireless protocol. The researcher notices that the protocol derives session keys by incrementing a counter and applying a key derivation function. The researcher has obtained two ciphertexts encrypted under keys that differ only by a known constant. Which attack is most applicable?

   • AMeet-in-the-middle attack on the key derivation function.
   • BDictionary attack using common passwords as keys.
   • CBirthday attack to find a collision in the ciphertexts.
   • DRelated-key attack, exploiting the known relationship between the keys to recover the master key or plaintext.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration tester is attempting to crack password hashes obtained from a Windows domain. The hashes are NTLM (unsalted). The tester has a limited time window and wants to maximize the number of passwords cracked. Which strategy would be most effective?

   • ARun a dictionary attack with a large wordlist and common password variations, then use rules to mutate the list.
   • BRun a pure brute-force attack over all 8-character combinations.
   • CUse a rainbow table for NTLM hashes.
   • DUse a side-channel attack on the authentication server.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What does an attacker do in a chosen-ciphertext attack?

   • AChooses ciphertexts and obtains their decryptions
   • BChooses plaintexts and obtains their encryptions
   • CUses a precomputed list of passwords
   • DIntercepts and modifies messages in transit
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a red-team engagement, you capture ciphertext from a legacy system that uses a classical substitution cipher. The ciphertext is long enough that you can analyze character frequencies. The most common letter in the ciphertext is 'X', and the second most common is 'Q'. Assuming the plaintext is English, which approach would most efficiently recover the plaintext?

   • APerform a chosen-plaintext attack by encrypting a known phrase and comparing the output.
   • BMap 'X' to 'E' and 'Q' to 'T', then iteratively refine the substitution based on repeated patterns and context.
   • CTry all 26! possible substitution mappings until the plaintext becomes readable.
   • DUse a dictionary attack with a list of common English words, trying each word as a potential key.
   Reveal Solution Discussion Select an answer first