Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security consultant is reviewing a web application that uses a custom encryption scheme for session cookies. The scheme uses a 64-bit key with the DES algorithm. The application is being updated to use a stronger algorithm, but the development team wants to minimize changes to the cookie format. What is the best recommendation?

   • AUse a simple XOR cipher with a longer key
   • BUse 3DES with the same 64-bit key
   • CUse RC4 with a 128-bit key to maintain the same cookie length
   • DUse AES-128 with a new key and update the cookie format
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a security review of a legacy web application, a penetration tester captures traffic and observes that the server negotiates TLS 1.0 with an RSA key exchange using a 1024-bit certificate. The application also uses MD5 for password hashing. Which finding should be prioritized as the most critical to remediate?

   • AThe 1024-bit RSA certificate, which is below the current minimum key length and can be factored with sufficient resources
   • BThe use of MD5 for password hashing, which is vulnerable to collision attacks
   • CThe use of RSA key exchange, which does not provide forward secrecy
   • DThe use of TLS 1.0, which is deprecated and vulnerable to known attacks such as BEAST and POODLE
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security analyst is reviewing a web application's configuration and finds that it uses a hash function to store passwords. The analyst notes that the hash function is known to be vulnerable to collision attacks and can be computed extremely quickly, allowing attackers to brute-force passwords at high speed. Which hash algorithm is the analyst most likely reviewing?

   • AHMAC-SHA256
   • BSHA-256
   • Cbcrypt
   • DMD5
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A developer is updating a web application's authentication system. The current code uses SHA-1 to hash passwords. The security team has mandated that all password hashes must be resistant to brute-force attacks and use a salt. Which algorithm should the developer choose?

   • AMD5 with a static salt
   • Bbcrypt with a unique salt per user
   • CAES-256 encryption of the password with a hardcoded key
   • DSHA-256 with a unique salt per user
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An auditor is reviewing a web server's SSL/TLS configuration. The server supports TLS 1.0, TLS 1.1, and TLS 1.2, and the cipher suite list includes 3DES, RC4, and AES-128-CBC. The application is a public-facing e-commerce site. Which finding should be reported as the highest risk?

   • AUse of RC4, which is a stream cipher that is no longer considered secure.
   • BLack of support for TLS 1.3, which is the only secure protocol version.
   • CUse of AES-128-CBC, which is a weak cipher mode that should be replaced with AES-GCM.
   • DSupport for TLS 1.0 and TLS 1.1, which are deprecated and vulnerable to known attacks like BEAST and POODLE.
   Reveal Solution Discussion Select an answer first