A penetration tester is using testssl.sh to assess a web server. The output shows that the server supports TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_RC4_128_SHA. Which finding is most critical?

The server supports AES-CBC, which is vulnerable to the BEAST attack.

The server supports SHA-1 for the MAC, which is vulnerable to collision attacks.

The server supports RC4, which is cryptographically broken and can lead to plaintext recovery.

The server uses RSA key exchange, which does not provide forward secrecy.

A developer is configuring a new web server and wants to ensure that the TLS handshake provides forward secrecy. Which cipher suite component is essential for this property?

Ephemeral Diffie-Hellman key exchange (DHE or ECDHE)

RSA key exchange with a 2048-bit key

A company's web application allows users to log in over HTTPS. A network attacker captures the TLS handshake and later obtains the server's private key through a separate breach. Which cipher suite, if used, would allow the attacker to decrypt the previously captured session?

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

Which of the following cipher suites is generally considered the strongest?

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 1

Weak SSL/TLS Ciphers WAHS Practice Questions (Page 5)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 21–25

21foundation · easy
Which of the following cipher algorithms is considered weak primarily because its 56-bit key length is too short to resist brute-force attacks?
Select an answer first
22application · medium
A penetration tester is using testssl.sh to assess a web server. The output shows that the server supports TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_RC4_128_SHA. Which finding is most critical?
Select an answer first
23application · medium
A developer is configuring a new web server and wants to ensure that the TLS handshake provides forward secrecy. Which cipher suite component is essential for this property?
Select an answer first
24application · medium
A company's web application allows users to log in over HTTPS. A network attacker captures the TLS handshake and later obtains the server's private key through a separate breach. Which cipher suite, if used, would allow the attacker to decrypt the previously captured session?
Select an answer first
25foundation · easy
Which of the following cipher suites is generally considered the strongest?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.