A security architect is reviewing a legacy web application that uses a combination of MD5 for password hashing and DES for encrypting session tokens. The application is being migrated to a cloud environment, and the architect must ensure compliance with PCI DSS, which requires strong cryptography. The migration team wants to minimize changes to the application code. Which approach should the architect recommend?

Use a hardware security module (HSM) to wrap the DES keys and continue using MD5 for passwords.

Replace MD5 with bcrypt and DES with AES-256, and update the application code to use the new algorithms.

Migrate the application to a cloud provider that offers encryption as a service, without changing the application code.

Implement a reverse proxy that decrypts and re-encrypts traffic using AES, while the application continues using DES internally.

A system administrator is updating the TLS configuration of a web server. The server currently supports SSLv3 and TLS 1.0. The administrator wants to disable weak protocols while ensuring that the web application remains accessible to all current browsers. Which action should be taken?

Disable SSLv3 and TLS 1.0, and enable TLS 1.2 and TLS 1.3.

Disable SSLv3 only and keep TLS 1.0 enabled.

Keep SSLv3 enabled but disable TLS 1.0.

Disable all TLS versions and use SSLv3 only.

A development team is building a web application that will store sensitive user data. The team is considering using AES-128 for encryption and SHA-256 for hashing. A security consultant recommends using AES-256 and SHA-512 instead. The team is concerned about performance and cost. Which decision is most appropriate?

Use AES-256 for encryption and SHA-256 for hashing, as the encryption key size is more important.

Use AES-128 for encryption and SHA-512 for hashing to balance security and performance.

Use AES-256 and SHA-512 to ensure maximum security, regardless of performance impact.

Use AES-128 and SHA-256, as they are currently considered secure and provide adequate protection.

A development team is building a new web application and needs to store API keys securely. They plan to use a hardware security module (HSM) to manage encryption keys. Which practice is essential for the secure use of the HSM?

Store the HSM's master key in the application's configuration file

Use a single key for all encryption operations to simplify management

Back up the HSM's keys to a cloud storage bucket for disaster recovery

Use the HSM to generate and store keys, and never export private keys

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 2

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 4)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 16–20

16expert · hard
A security architect is reviewing a legacy web application that uses a combination of MD5 for password hashing and DES for encrypting session tokens. The application is being migrated to a cloud environment, and the architect must ensure compliance with PCI DSS, which requires strong cryptography. The migration team wants to minimize changes to the application code. Which approach should the architect recommend?
Select an answer first
17application · medium
A developer is implementing a file integrity monitoring system and needs to generate checksums for files. The current system uses MD5. The security team requires that the checksums be collision-resistant. Which algorithm should be used?
Select an answer first
18application · medium
A system administrator is updating the TLS configuration of a web server. The server currently supports SSLv3 and TLS 1.0. The administrator wants to disable weak protocols while ensuring that the web application remains accessible to all current browsers. Which action should be taken?
Select an answer first
19expert · hard
A development team is building a web application that will store sensitive user data. The team is considering using AES-128 for encryption and SHA-256 for hashing. A security consultant recommends using AES-256 and SHA-512 instead. The team is concerned about performance and cost. Which decision is most appropriate?
Select an answer first
20application · medium
A development team is building a new web application and needs to store API keys securely. They plan to use a hardware security module (HSM) to manage encryption keys. Which practice is essential for the secure use of the HSM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 4)

Questions 16–20

A developer is implementing a file integrity monitoring system and needs to generate checksums for files. The current system uses MD5. The security team requires that the checksums be collision-resistant. Which algorithm should be used?

A system administrator is updating the TLS configuration of a web server. The server currently supports SSLv3 and TLS 1.0. The administrator wants to disable weak protocols while ensuring that the web application remains accessible to all current browsers. Which action should be taken?

A development team is building a new web application and needs to store API keys securely. They plan to use a hardware security module (HSM) to manage encryption keys. Which practice is essential for the secure use of the HSM?

Keep studying — Cryptographic Failures and Transport Security