A security tester is reviewing a system that stores passwords using a hash function. The tester notices that the system uses MD5 without a salt. What is the primary weakness of this approach?

MD5 is an encryption algorithm, and the passwords can be decrypted if the key is known.

MD5 is a symmetric encryption algorithm, so the key must be managed securely.

MD5 is a fast hash, making it susceptible to brute-force and rainbow table attacks.

MD5 produces a short hash, which increases the chance of collisions.

Why is regular key rotation important in key management?

To reduce the storage space required for keys

To ensure the key is compatible with all algorithms

To reduce the impact of a compromised key by limiting the amount of data encrypted with it

What is the primary purpose of using TLS for data in transit?

To compress data to reduce bandwidth usage

To provide confidentiality and integrity of data as it travels over the network

To authenticate users at the application layer

To prevent denial-of-service attacks

A security tester is assessing a legacy application that uses DES for encrypting sensitive data. The tester needs to recommend a replacement that provides stronger security while maintaining compatibility with existing data. What should the tester recommend?

Migrate to AES-256 and re-encrypt all existing data during the transition.

Increase the DES key length to 256 bits to improve security without changing the algorithm.

Use RSA encryption for the data at rest, as it is stronger than DES.

Use 3DES with a 112-bit effective key length to maintain compatibility with existing DES data.

Certified Tester Security Test Engineer

Domain 2Objective 6

Encryption CT-STE Practice Questions (Page 6)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

10concepts

Questions 26–30

26application · medium
A security tester is reviewing a system that stores passwords using a hash function. The tester notices that the system uses MD5 without a salt. What is the primary weakness of this approach?
Select an answer first
27foundation · easy
Why is regular key rotation important in key management?
Select an answer first
28foundation · easy
What is the primary purpose of using TLS for data in transit?
Select an answer first
29foundation · easy
Which of the following is generally considered a weak or deprecated encryption algorithm?
Select an answer first
30application · medium
A security tester is assessing a legacy application that uses DES for encrypting sensitive data. The tester needs to recommend a replacement that provides stronger security while maintaining compatibility with existing data. What should the tester recommend?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.