A security analyst is analyzing a ciphertext that is known to be encrypted with a monoalphabetic substitution cipher. The analyst notices that the ciphertext contains many repeated digraphs like 'TH' and 'HE'. How can this observation assist in the cryptanalysis?

Determine the key length by finding the distance between repeated digraphs.

Ignore the digraphs because they are not useful for monoalphabetic substitution ciphers.

Use the digraphs to directly compute the substitution key without needing letter frequencies.

Use the frequency of common digraphs to help identify the mapping for individual letters.

A security team is analyzing a ciphertext that was produced by a Vigenère cipher. They attempt to apply standard single-letter frequency analysis but find that the letter frequencies are nearly uniform. What is the most likely reason for this observation?

The Vigenère cipher uses multiple substitution alphabets, flattening single-letter frequencies

The key is longer than the plaintext

The ciphertext is too short for frequency analysis

The plaintext was compressed before encryption

An analyst has a long ciphertext from a monoalphabetic substitution cipher. The analyst notices that the ciphertext letter 'M' appears very frequently, and the digraph 'MN' appears often. The analyst suspects that 'M' maps to 'E' and 'N' maps to 'T'. What should the analyst do next to validate this hypothesis?

Check if the ciphertext contains the letter 'Q'

Look for the pattern '_E_T' in the partially decrypted text to identify common words

Use a different cipher, such as Vigenère, to decrypt

Assume the mapping is correct and decrypt the entire message

A cryptanalyst is studying a block cipher and wants to apply differential cryptanalysis. The analyst chooses pairs of plaintexts with a fixed XOR difference and observes the corresponding ciphertext differences. What is the primary goal of this analysis?

To measure the avalanche effect of the cipher

To find a differential characteristic with high probability that can be used to recover key bits

To determine the S-box lookup table

To identify the block size of the cipher

EC-CouncilCertified Encryption Specialist

Domain 5Objective 1

Frequency Analysis and Differential Cryptanalysis ECES Practice Questions (Page 4)

Part of the Cryptanalysis domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 16–20

16application · medium
A security analyst is analyzing a ciphertext that is known to be encrypted with a monoalphabetic substitution cipher. The analyst notices that the ciphertext contains many repeated digraphs like 'TH' and 'HE'. How can this observation assist in the cryptanalysis?
Select an answer first
17expert · medium
An analyst is constructing a differential characteristic for a block cipher and has identified a 2-round characteristic with probability 2^-8. The analyst wants to extend it to a 4-round characteristic. The best extension found has a probability of 2^-6 for the additional 2 rounds. What is the probability of the full 4-round characteristic?
Select an answer first
18application · medium
A security team is analyzing a ciphertext that was produced by a Vigenère cipher. They attempt to apply standard single-letter frequency analysis but find that the letter frequencies are nearly uniform. What is the most likely reason for this observation?
Select an answer first
19application · medium
An analyst has a long ciphertext from a monoalphabetic substitution cipher. The analyst notices that the ciphertext letter 'M' appears very frequently, and the digraph 'MN' appears often. The analyst suspects that 'M' maps to 'E' and 'N' maps to 'T'. What should the analyst do next to validate this hypothesis?
Select an answer first
20application · medium
A cryptanalyst is studying a block cipher and wants to apply differential cryptanalysis. The analyst chooses pairs of plaintexts with a fixed XOR difference and observes the corresponding ciphertext differences. What is the primary goal of this analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.

Frequency Analysis and Differential Cryptanalysis ECES Practice Questions (Page 4)

Questions 16–20

A security analyst is analyzing a ciphertext that is known to be encrypted with a monoalphabetic substitution cipher. The analyst notices that the ciphertext contains many repeated digraphs like 'TH' and 'HE'. How can this observation assist in the cryptanalysis?

A security team is analyzing a ciphertext that was produced by a Vigenère cipher. They attempt to apply standard single-letter frequency analysis but find that the letter frequencies are nearly uniform. What is the most likely reason for this observation?

A cryptanalyst is studying a block cipher and wants to apply differential cryptanalysis. The analyst chooses pairs of plaintexts with a fixed XOR difference and observes the corresponding ciphertext differences. What is the primary goal of this analysis?

Keep studying — Cryptanalysis