A security analyst is investigating a breach where an attacker was able to extract a secret key from a cryptographic device by measuring the electromagnetic radiation emitted during operations. Which attack was used?

Timing attack, measuring operation times

Brute force attack, trying all possible keys

Fault injection attack, inducing voltage glitches

Side-channel attack, exploiting electromagnetic leaks

A security engineer is investigating a suspected data breach involving a hardware security module (HSM) used for cryptographic operations. The attacker had physical access to the device for a short period. Which type of attack is most likely to have been used to extract secret keys?

Pass the hash attack, using captured password hashes to authenticate

Known-plaintext attack, using known plaintext-ciphertext pairs from the HSM

Brute force attack, trying all possible keys until the correct one is found

Side-channel attack, analyzing power consumption or electromagnetic emissions during cryptographic operations

A cryptanalyst is trying to break a classical cipher that uses a monoalphabetic substitution. The analyst has a large amount of ciphertext but no known plaintext. Which technique is most likely to succeed?

Frequency analysis, comparing the frequency of symbols in the ciphertext to known letter frequencies

Brute force attack, trying all possible substitution keys

Chosen-ciphertext attack, but the analyst does not have a decryption oracle

Known-plaintext attack, but the analyst has no known plaintext

What is a key mitigation for Kerberos attacks such as Kerberoasting and golden ticket attacks?

Using strong, complex passwords for service accounts and regularly rotating the KRBTGT account password

Disabling all Kerberos authentication

Encrypting all network traffic with TLS

Certified Information Systems Security Professional

Domain 3Objective 7

3.7 - Understand Methods of Cryptanalytic Attacks CISSP Practice Questions (Page 8)

Part of the Security Architecture and Engineering domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

13concepts

13%of the exam

Questions 36–40

36application · medium
A security analyst is investigating a breach where an attacker was able to extract a secret key from a cryptographic device by measuring the electromagnetic radiation emitted during operations. Which attack was used?
Select an answer first
37application · medium
A security engineer is investigating a suspected data breach involving a hardware security module (HSM) used for cryptographic operations. The attacker had physical access to the device for a short period. Which type of attack is most likely to have been used to extract secret keys?
Select an answer first
38application · medium
A cryptanalyst is trying to break a classical cipher that uses a monoalphabetic substitution. The analyst has a large amount of ciphertext but no known plaintext. Which technique is most likely to succeed?
Select an answer first
39foundation · easy
What is a key mitigation for Kerberos attacks such as Kerberoasting and golden ticket attacks?
Select an answer first
40foundation · easy
Which attack relies solely on intercepted ciphertext and statistical patterns to recover plaintext?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.