hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: During a security assessment, a penetration…
During a security assessment, a penetration tester discovers that a web application uses a custom encryption algorithm to protect session tokens. According to secure engineering principles, what is the primary concern?
⚠ Common exam trap
CompTIA emphasizes that security through obscurity (custom algorithms) is fundamentally flawed, and candidates mistakenly focus on implementation details like key length or performance instead of the critical lack of peer review.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lack of peer review and cryptanalysis
The primary concern with a custom encryption algorithm is the lack of peer review and cryptanalysis. Without rigorous public scrutiny by the cryptographic community, hidden vulnerabilities or backdoors may remain undetected, violating the secure engineering principle of using well-vetted, standard cryptographic primitives. This is a foundational principle in security engineering, as custom algorithms often fail to withstand known attack vectors like differential or linear cryptanalysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performance overhead of the custom algorithm
Why it's wrong here
While performance may be a concern, the security principle prioritizes using vetted algorithms over custom ones.
- ✗
Insufficient key length used in the algorithm
Why it's wrong here
Key length could be insufficient, but the root issue is the algorithm itself, not the key length.
- ✗
Incompatibility with modern browsers
Why it's wrong here
Browser compatibility is irrelevant; custom algorithms are not used in standard TLS.
- ✓
Lack of peer review and cryptanalysis
Why this is correct
Custom algorithms have not been scrutinized by the cryptographic community, making them vulnerable to undiscovered weaknesses.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.