A security analyst is reviewing the TLS configuration of a web server using an online scanner. The scanner reports that the server supports the cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA. What is the primary security concern with this cipher suite?

It uses RSA key exchange, which does not provide forward secrecy

It uses CBC mode, which is vulnerable to padding oracle attacks

It uses 3DES, which has a small block size and is vulnerable to Sweet32 attacks

It uses SHA-1 for message authentication, which is deprecated

A developer is implementing password storage for a new web application. The developer currently uses a custom hashing function based on MD5 with a single salt for all users. Which change should be made to improve security?

Use MD5 with a longer salt for each user.

Use bcrypt or Argon2 with a unique salt for each user.

Encrypt the passwords using AES-256 and store the key in the database.

Use SHA-256 with the same salt for all users.

A security engineer is reviewing the TLS configuration of a legacy web application that handles customer session cookies. The engineer captures traffic and observes that the server negotiates TLS 1.0 with a cipher suite that uses RC4 for bulk encryption. The application also stores passwords using MD5 hashes. Which immediate remediation should the engineer prioritize?

Increase the RC4 key length to 256 bits and keep TLS 1.0 for compatibility.

Enable TLS 1.3 only and remove all other protocol versions from the server configuration.

Replace MD5 with SHA-256 for password hashing and add a salt to each hash.

Disable TLS 1.0 and RC4 on the server, and enforce TLS 1.2 or higher with AES-GCM cipher suites.

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 2

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 1)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 1–5

1foundation · easy
A penetration tester is examining a web server's SSL/TLS configuration and notices that it supports a protocol version that uses the RC4 stream cipher and is vulnerable to the POODLE attack. Which protocol version is this?
Select an answer first
2application · medium
A security analyst is reviewing the TLS configuration of a web server using an online scanner. The scanner reports that the server supports the cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA. What is the primary security concern with this cipher suite?
Select an answer first
3application · medium
A developer is implementing password storage for a new web application. The developer currently uses a custom hashing function based on MD5 with a single salt for all users. Which change should be made to improve security?
Select an answer first
4application · medium
A security engineer is reviewing the TLS configuration of a legacy web application that handles customer session cookies. The engineer captures traffic and observes that the server negotiates TLS 1.0 with a cipher suite that uses RC4 for bulk encryption. The application also stores passwords using MD5 hashes. Which immediate remediation should the engineer prioritize?
Select an answer first
5application · medium
A web application uses a custom encryption routine that employs the RC4 stream cipher to encrypt session tokens. The security team has identified that RC4 is weak and must be replaced. Which replacement would be most appropriate for encrypting session tokens?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 1)

Questions 1–5

A penetration tester is examining a web server's SSL/TLS configuration and notices that it supports a protocol version that uses the RC4 stream cipher and is vulnerable to the POODLE attack. Which protocol version is this?

A security analyst is reviewing the TLS configuration of a web server using an online scanner. The scanner reports that the server supports the cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA. What is the primary security concern with this cipher suite?

A developer is implementing password storage for a new web application. The developer currently uses a custom hashing function based on MD5 with a single salt for all users. Which change should be made to improve security?

A web application uses a custom encryption routine that employs the RC4 stream cipher to encrypt session tokens. The security team has identified that RC4 is weak and must be replaced. Which replacement would be most appropriate for encrypting session tokens?

Keep studying — Cryptographic Failures and Transport Security