A security analyst is performing a traffic analysis of a web application and observes that the server negotiates TLS 1.0 with a cipher suite that uses CBC mode. The analyst also notices that the server's certificate is signed with SHA-1. The application is a government portal that must comply with FIPS 140-2. Which finding is the most critical?

The use of a SHA-1 certificate, which is no longer trusted by modern browsers.

The use of CBC mode, which is vulnerable to padding oracle attacks.

The use of TLS 1.0, which is deprecated and vulnerable to BEAST and other attacks.

The lack of support for TLS 1.3, which is required by FIPS 140-2.

A development team is designing a new authentication system for a web application. They need to store user passwords securely and also sign JSON Web Tokens (JWTs) for session management. Which combination of algorithms meets current security best practices?

Use SHA-1 for password storage and ES256 (ECDSA with SHA-256) for JWT signing.

Use AES-256 encryption for password storage and none algorithm for JWT signing.

Use bcrypt with a cost factor of 12 for password storage and RS256 (RSA with SHA-256) for JWT signing.

Use MD5 with a static salt for password storage and HS256 for JWT signing.

A company is migrating its web application to a new server. The security policy requires that all client connections use strong encryption. The server will support a mix of modern and older clients. Which configuration best balances security and compatibility?

Enable TLS 1.2 and TLS 1.3, and disable SSLv3, TLS 1.0, and TLS 1.1.

Enable only TLS 1.3, as it is the most secure protocol version.

Enable TLS 1.0 and TLS 1.1 only, as they are the most compatible with older browsers.

Enable SSLv3 and TLS 1.0 for maximum compatibility with legacy clients.

A financial institution is required to protect customer data with strong encryption. They currently use a legacy system that encrypts data with DES. The system is being replaced, but the migration will take six months. During this period, what is the most effective way to mitigate the risk of using DES?

Implement a compensating control such as network segmentation and monitoring, and accelerate the migration

Use DES only for legacy data and encrypt all new data with AES-256

Layer DES with AES-256 using a pre-encryption step

Triple DES (3DES) with three independent keys

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 2

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 5)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 21–25

21expert · hard
A security analyst is performing a traffic analysis of a web application and observes that the server negotiates TLS 1.0 with a cipher suite that uses CBC mode. The analyst also notices that the server's certificate is signed with SHA-1. The application is a government portal that must comply with FIPS 140-2. Which finding is the most critical?
Select an answer first
22application · medium
A development team is designing a new authentication system for a web application. They need to store user passwords securely and also sign JSON Web Tokens (JWTs) for session management. Which combination of algorithms meets current security best practices?
Select an answer first
23application · medium
A company is migrating its web application to a new server. The security policy requires that all client connections use strong encryption. The server will support a mix of modern and older clients. Which configuration best balances security and compatibility?
Select an answer first
24expert · hard
A financial institution is required to protect customer data with strong encryption. They currently use a legacy system that encrypts data with DES. The system is being replaced, but the migration will take six months. During this period, what is the most effective way to mitigate the risk of using DES?
Select an answer first
25foundation · easy
During a code review, a developer finds that a legacy web application uses a symmetric block cipher with a 56-bit key to encrypt session tokens. The cipher is known to be susceptible to brute-force attacks due to its short key length. Which algorithm is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 5)

Questions 21–25

A development team is designing a new authentication system for a web application. They need to store user passwords securely and also sign JSON Web Tokens (JWTs) for session management. Which combination of algorithms meets current security best practices?

A company is migrating its web application to a new server. The security policy requires that all client connections use strong encryption. The server will support a mix of modern and older clients. Which configuration best balances security and compatibility?

During a code review, a developer finds that a legacy web application uses a symmetric block cipher with a 56-bit key to encrypt session tokens. The cipher is known to be susceptible to brute-force attacks due to its short key length. Which algorithm is being used?

Keep studying — Cryptographic Failures and Transport Security