CEH Cryptography and Malware Analysis Practice Question

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

⚠ Common exam trap

Many candidates confuse 'encrypted in transit' (TLS) with 'encrypted at the application layer,' assuming HTTPS alone provides end-to-end data confidentiality, but the CEH exam tests the distinction between transport-layer and application-layer encryption.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Lack of application-layer encryption

The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Weak TLS cipher suite
Why it's wrong here
A weak TLS cipher suite would indicate a vulnerability in the cryptographic algorithms used for the transport layer (HTTPS) itself, potentially allowing an attacker to decrypt traffic in transit. However, the problem statement implies HTTPS is correctly implemented for secure transmission, meaning the issue lies beyond the integrity of the TLS handshake or the strength of its ciphers. The core problem is not about how data is transmitted securely, but what data is encrypted by the application before transmission or at rest, making this option incorrect.
✓
Lack of application-layer encryption
Why this is correct
This is the correct answer because while HTTPS encrypts data in transit between the client and server, it does not inherently encrypt data at the application layer before it is sent or when it is stored. If sensitive fields are not encrypted by the application itself, they could be exposed in memory, logs, or databases on the server side, even if the network communication is secure. The application's failure to encrypt sensitive data before processing or storage creates a vulnerability independent of transport security.
✗
SSL stripping attack
Why it's wrong here
An SSL stripping attack, often executed via a Man-in-the-Middle (MITM) position, involves downgrading an HTTPS connection to an unencrypted HTTP connection, allowing the attacker to intercept plain-text traffic. The question does not provide any indicators of such an active downgrade attack, nor does it suggest that the connection itself was compromised to remove TLS. The scenario describes an issue where data remains unencrypted within the application context, despite an active HTTPS connection, making this option irrelevant.
✗
Man-in-the-middle attack
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and potentially altering the communication between two parties who believe they are directly communicating. While MITM attacks can target various protocols, HTTPS, when properly implemented with valid certificates, is designed to prevent such attacks by ensuring the authenticity of the server and the integrity and confidentiality of the data in transit. The problem described points to an application-level vulnerability, not a compromise of the secure transport channel itself, thus ruling out a MITM attack as the primary issue.

Go deeper

CEH Cryptography and Malware Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question