CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security team discovers that an attacker has been intercepting and modifying traffic between a client and server by impersonating both endpoints. Which type of cryptographic attack is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-middle attack
A man-in-the-middle (MITM) attack involves the attacker positioning themselves between the client and server to intercept and modify traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Man-in-the-middle attack
Why this is correct
A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and potentially altering the communication between two parties who believe they are directly communicating with each other. The attacker positions themselves between the victim and the legitimate server, intercepting all traffic and often impersonating both ends. This allows for real-time eavesdropping, data modification, and session hijacking, directly matching the scenario of an attacker intercepting communication.
- ✗
Replay attack
Why it's wrong here
A replay attack captures a legitimate data transmission, such as authentication credentials or session tokens, and then retransmits it later to gain unauthorized access or achieve an illicit effect. While it involves initial interception, the attacker typically does not actively modify the content or continuously mediate the communication flow between the original parties. Instead, the focus is on reusing previously valid data, not real-time impersonation.
- ✗
Downgrade attack
Why it's wrong here
A downgrade attack specifically manipulates the connection setup process to force two communicating parties to use an older, less secure version of a protocol or cipher suite. This weakens the cryptographic protections, making the communication vulnerable to other attacks like eavesdropping, but it does not inherently involve the attacker actively intercepting and impersonating parties in the ongoing data exchange. Its primary goal is to reduce security, not to mediate traffic.
- ✗
Birthday attack
Why it's wrong here
A birthday attack is a cryptographic attack that exploits the probability theory behind the birthday problem to find collisions in hash functions. The attacker aims to find two distinct inputs that produce the same hash output, which can be used to forge digital signatures or compromise password hashes. This attack operates on the mathematical properties of hashing algorithms and is entirely unrelated to network traffic interception or real-time communication impersonation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.