A company's web application is accessible over the internet and uses a certificate signed with SHA-1. The certificate authority has announced that SHA-1 certificates are no longer trusted by modern browsers. What is the immediate action required?

Renew the certificate with a SHA-256 signed certificate

Disable certificate validation in the browser

Continue using the certificate until it expires

Use a self-signed certificate with SHA-1

An organization is evaluating a new web application that uses a 2048-bit RSA certificate and supports TLS 1.3. However, the application also accepts connections using a cipher suite that uses RC4. What should the security team do?

Accept the configuration because the certificate and protocol are strong

Upgrade the certificate to 4096-bit RSA

Require clients to use a VPN to access the application

Disable RC4 and configure the server to use only AEAD cipher suites

A company is migrating its public web application to a new server and wants to ensure that only strong cryptographic protocols are supported. The current configuration allows SSLv3, TLS 1.0, TLS 1.1, and TLS 1.2. The compliance team requires that all traffic be protected against known protocol-level attacks. Which configuration should be applied?

Disable SSLv3 and TLS 1.0, keep TLS 1.1 and TLS 1.2 enabled

Keep SSLv3 enabled but disable TLS 1.0 and TLS 1.1

Disable SSLv3, TLS 1.0, and TLS 1.1, and enable only TLS 1.2 and TLS 1.3

Enable only TLS 1.0 and TLS 1.2, disabling SSLv3 and TLS 1.1

A penetration tester is assessing a web application that uses a custom encryption library. The library uses DES with a 56-bit key to encrypt sensitive data in transit. The tester also notices that the application accepts SHA-1 certificates for TLS connections. Which action should the tester recommend?

Replace DES with AES-256 and require certificates signed with SHA-256 or stronger.

Use 3DES instead of DES and keep SHA-1 certificates for compatibility.

Switch to RC4 for encryption and use MD5 for certificate signatures.

Increase the DES key length to 128 bits and continue using SHA-1 certificates.

A cloud-based application uses a load balancer to terminate TLS. The security team needs to ensure that the encryption strength meets PCI DSS requirements, which mandate strong cryptography. The load balancer currently supports TLS 1.2 with AES-128-CBC and TLS 1.3 with AES-256-GCM. What is the best configuration to meet PCI DSS?

Keep both TLS 1.2 and TLS 1.3 with all current cipher suites

Enable both TLS 1.2 and TLS 1.3, but disable AES-128-CBC

Enable only TLS 1.3 with AES-256-GCM

Use TLS 1.2 with AES-256-CBC instead of AES-128-CBC

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 2

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 2)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 6–10

6application · medium
A company's web application is accessible over the internet and uses a certificate signed with SHA-1. The certificate authority has announced that SHA-1 certificates are no longer trusted by modern browsers. What is the immediate action required?
Select an answer first
7application · medium
An organization is evaluating a new web application that uses a 2048-bit RSA certificate and supports TLS 1.3. However, the application also accepts connections using a cipher suite that uses RC4. What should the security team do?
Select an answer first
8application · medium
A company is migrating its public web application to a new server and wants to ensure that only strong cryptographic protocols are supported. The current configuration allows SSLv3, TLS 1.0, TLS 1.1, and TLS 1.2. The compliance team requires that all traffic be protected against known protocol-level attacks. Which configuration should be applied?
Select an answer first
9application · medium
A penetration tester is assessing a web application that uses a custom encryption library. The library uses DES with a 56-bit key to encrypt sensitive data in transit. The tester also notices that the application accepts SHA-1 certificates for TLS connections. Which action should the tester recommend?
Select an answer first
10expert · hard
A cloud-based application uses a load balancer to terminate TLS. The security team needs to ensure that the encryption strength meets PCI DSS requirements, which mandate strong cryptography. The load balancer currently supports TLS 1.2 with AES-128-CBC and TLS 1.3 with AES-256-GCM. What is the best configuration to meet PCI DSS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 2)

Questions 6–10

A company's web application is accessible over the internet and uses a certificate signed with SHA-1. The certificate authority has announced that SHA-1 certificates are no longer trusted by modern browsers. What is the immediate action required?

An organization is evaluating a new web application that uses a 2048-bit RSA certificate and supports TLS 1.3. However, the application also accepts connections using a cipher suite that uses RC4. What should the security team do?

Keep studying — Cryptographic Failures and Transport Security