How should I use these Cryptography and Malware Analysis practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Cryptography and Malware Analysis questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Cryptography and Malware Analysis domain.

CEH · topic practice

Cryptography and Malware Analysis practice questions

Practise Certified Ethical Hacker CEH Cryptography and Malware Analysis practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Cryptography and Malware Analysis

Practice 10 questions Browse domain →

What the exam tests

What to know about Cryptography and Malware Analysis

Cryptography and Malware Analysis questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Cryptography and Malware Analysis exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Cryptography and Malware Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Cryptography and Malware Analysis explanation →

Which THREE of the following are types of cryptanalytic attacks? (Choose three.)

Trap 1: Rainbow table attack

A rainbow table attack is a precomputed table lookup technique specifically designed to reverse cryptographic hash functions, primarily used for cracking password hashes. It works by storing precomputed chains of hash values and their corresponding original inputs, allowing for a faster lookup than brute-forcing each hash. This method does not directly analyze the internal structure or key of an encryption algorithm to find weaknesses, making it distinct from cryptanalytic attacks on ciphers.

Trap 2: Replay attack

A replay attack involves intercepting a valid data transmission and then retransmitting it, often to impersonate a legitimate user, repeat an authorized action, or bypass authentication mechanisms. This is a network-level attack on communication protocols or session integrity, exploiting weaknesses in how cryptographic primitives are *used* within a system. It does not involve breaking the underlying cryptographic algorithm itself or recovering its secret key, thus it is not a cryptanalytic technique.

Study all Cryptography and Malware Analysis common traps →

A
Differential cryptanalysis
Differential cryptanalysis is a chosen-plaintext attack that meticulously analyzes how differences in input plaintexts propagate through the various rounds of a block cipher to produce differences in the corresponding ciphertexts. By observing the statistical properties of these difference propagations, an attacker can deduce information about the secret key. This technique is particularly effective against iterated block ciphers, such as DES, by identifying non-random behavior in the difference distribution.
B
Rainbow table attack
Why wrong: A rainbow table attack is a precomputed table lookup technique specifically designed to reverse cryptographic hash functions, primarily used for cracking password hashes. It works by storing precomputed chains of hash values and their corresponding original inputs, allowing for a faster lookup than brute-forcing each hash. This method does not directly analyze the internal structure or key of an encryption algorithm to find weaknesses, making it distinct from cryptanalytic attacks on ciphers.
C
Linear cryptanalysis
Linear cryptanalysis is a known-plaintext attack that seeks to find linear approximations between the plaintext bits, ciphertext bits, and subkey bits of a block cipher. It constructs linear equations that hold with a probability significantly different from 1/2, indicating a statistical bias in the cipher's behavior. By collecting a sufficient number of plaintext/ciphertext pairs, an attacker can exploit these biases to deduce key bits, often requiring fewer resources than a brute-force attack.
D
Brute-force attack
A brute-force attack is a fundamental cryptanalytic method that systematically attempts every possible key in the entire keyspace until the correct key is found. The success of the attack is typically confirmed when the decrypted ciphertext yields intelligible plaintext or a known checksum. While computationally intensive and often impractical for large key sizes, it is a universal attack that, given enough time and resources, will eventually succeed against any encryption scheme.
E
Replay attack
Why wrong: A replay attack involves intercepting a valid data transmission and then retransmitting it, often to impersonate a legitimate user, repeat an authorized action, or bypass authentication mechanisms. This is a network-level attack on communication protocols or session integrity, exploiting weaknesses in how cryptographic primitives are *used* within a system. It does not involve breaking the underlying cryptographic algorithm itself or recovering its secret key, thus it is not a cryptanalytic technique.

Full breakdown with real-world context →

Question 2mediummulti select

Read the full Cryptography and Malware Analysis explanation →

A malware analyst is investigating a suspicious executable that appears to be a Trojan. The analyst runs the executable in a sandbox and observes the following behavior: it creates a hidden file in the %AppData% directory, modifies the Windows registry to add a startup entry, and attempts to connect to an external IP address on port 443 using HTTPS. Which TWO of the following techniques are likely being used by this malware?

Trap 1: Keylogging

Keylogging involves the surreptitious recording of user keystrokes, often through API hooking, kernel-level drivers, or direct hardware interception. The provided scenario does not describe any observed behavior related to capturing keyboard input, such as monitoring user activity or transmitting keystroke data. Therefore, attributing keylogging functionality to the malware based solely on the given information is unsubstantiated.

Trap 2: Fileless execution

Fileless execution refers to malware that operates entirely in memory, leveraging legitimate system processes and tools (e.g., PowerShell, WMI, living-off-the-land binaries) to avoid writing any artifacts to the disk. The description explicitly states that the malware creates a hidden file on disk, which is a direct contradiction to the core principle of fileless operation. This disk-based artifact immediately disqualifies it from being categorized as fileless.

Trap 3: Privilege escalation

Privilege escalation is the act of gaining higher access rights on a system than initially possessed, such as moving from a standard user account to an administrator or SYSTEM account. This typically involves exploiting vulnerabilities, misconfigurations, or leveraging User Account Control (UAC) bypass techniques. The provided information does not describe any actions indicative of attempting to elevate privileges, such as exploiting a kernel vulnerability or attempting to bypass User Account Control.

Study all Cryptography and Malware Analysis common traps →

A
Keylogging
Why wrong: Keylogging involves the surreptitious recording of user keystrokes, often through API hooking, kernel-level drivers, or direct hardware interception. The provided scenario does not describe any observed behavior related to capturing keyboard input, such as monitoring user activity or transmitting keystroke data. Therefore, attributing keylogging functionality to the malware based solely on the given information is unsubstantiated.
B
Fileless execution
Why wrong: Fileless execution refers to malware that operates entirely in memory, leveraging legitimate system processes and tools (e.g., PowerShell, WMI, living-off-the-land binaries) to avoid writing any artifacts to the disk. The description explicitly states that the malware creates a hidden file on disk, which is a direct contradiction to the core principle of fileless operation. This disk-based artifact immediately disqualifies it from being categorized as fileless.
C
Persistence mechanism
A persistence mechanism is any technique employed by malware to ensure its continued execution across system reboots, user logoffs, or process terminations. Adding an entry to a startup registry key, such as HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, is a quintessential method. This ensures the malicious executable automatically launches every time the system starts or a user logs in, thereby maintaining its presence on the compromised host.
D
Privilege escalation
Why wrong: Privilege escalation is the act of gaining higher access rights on a system than initially possessed, such as moving from a standard user account to an administrator or SYSTEM account. This typically involves exploiting vulnerabilities, misconfigurations, or leveraging User Account Control (UAC) bypass techniques. The provided information does not describe any actions indicative of attempting to elevate privileges, such as exploiting a kernel vulnerability or attempting to bypass User Account Control.
E
Command and control communication
Command and Control (C2) communication refers to the channel established by malware to communicate with an attacker-controlled server, enabling remote management, command execution, and data exfiltration. Connecting to an external IP address over HTTPS is a highly characteristic indicator of C2 activity. HTTPS is frequently used to encrypt communications and evade detection by blending in with legitimate web traffic, making it a preferred protocol for establishing covert C2 channels.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Cryptography and Malware Analysis explanation →

Refer to the exhibit. A security analyst runs netstat on a compromised Windows machine. Based on the output, which process is most likely associated with the malicious activity?

Exhibit

Refer to the exhibit.

C:\Users\Admin>netstat -anob

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    192.168.1.10:49152     203.0.113.5:4444       ESTABLISHED     1234
  TCP    192.168.1.10:49153     198.51.100.20:80       TIME_WAIT       5678
  [svchost.exe]
  TCP    192.168.1.10:49154     203.0.113.5:4444       ESTABLISHED     1234
  [explorer.exe]

Trap 1: The process with PID 1234 is not identified

The claim that PID 1234 is not identified is incorrect. The `netstat -ano` command output explicitly associates PID 1234 with the `explorer.exe` process in the final column, which identifies the owning process for each network connection. This functionality is precisely why the `-o` switch is used with `netstat`, providing crucial process context for network activity analysis.

Trap 2: svchost.exe (PID 5678)

The `svchost.exe` process (PID 5678) connecting to port 80 (HTTP) in a `TIME_WAIT` state is generally less suspicious. `svchost.exe` is a legitimate Windows process that hosts numerous services, many of which may legitimately access HTTP resources. The `TIME_WAIT` state indicates that the connection has recently been closed, which is a normal part of the TCP connection termination sequence, rather than an active or persistent malicious connection.

Trap 3: The process with PID 5678 is not identified

The assertion that PID 5678 is not identified is false. The `netstat -ano` command output clearly shows `svchost.exe` listed in the 'Image Name' column corresponding to PID 5678. The `-o` flag in `netstat` is specifically designed to provide this process identification, linking network activity directly to the executable responsible for it.

Study all Cryptography and Malware Analysis common traps →

A
The process with PID 1234 is not identified
Why wrong: The claim that PID 1234 is not identified is incorrect. The `netstat -ano` command output explicitly associates PID 1234 with the `explorer.exe` process in the final column, which identifies the owning process for each network connection. This functionality is precisely why the `-o` switch is used with `netstat`, providing crucial process context for network activity analysis.
B
explorer.exe (PID 1234)
The connection initiated by `explorer.exe` (PID 1234) to a foreign IP address on port 4444 is highly suspicious. While `explorer.exe` is the Windows shell, it typically does not initiate outbound network connections to arbitrary external IPs, especially not on a non-standard port like 4444, which is frequently associated with reverse shells or command-and-control (C2) channels used by malware. This activity strongly suggests a compromise, as malware often injects into legitimate processes or masquerades as them to evade detection.
C
svchost.exe (PID 5678)
Why wrong: The `svchost.exe` process (PID 5678) connecting to port 80 (HTTP) in a `TIME_WAIT` state is generally less suspicious. `svchost.exe` is a legitimate Windows process that hosts numerous services, many of which may legitimately access HTTP resources. The `TIME_WAIT` state indicates that the connection has recently been closed, which is a normal part of the TCP connection termination sequence, rather than an active or persistent malicious connection.
D
The process with PID 5678 is not identified
Why wrong: The assertion that PID 5678 is not identified is false. The `netstat -ano` command output clearly shows `svchost.exe` listed in the 'Image Name' column corresponding to PID 5678. The `-o` flag in `netstat` is specifically designed to provide this process identification, linking network activity directly to the executable responsible for it.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Cryptography and Malware Analysis explanation →

You are a security analyst for a financial institution. The company has deployed a network of 500 Windows 10 workstations and 50 servers running Windows Server 2019. All systems are protected by a next-generation firewall and an endpoint detection and response (EDR) solution. Recently, several employees reported that their workstations are running slowly and exhibiting unusual pop-up messages demanding a ransom note in Bitcoin. The EDR alerts show that a file named 'invoice.docm' was downloaded from an email attachment and executed on multiple workstations. The EDR also indicates that the file dropped a PowerShell script that connected to an external IP address and downloaded additional payloads. After the initial infection, the EDR detected that the ransomware binary 'encryptor.exe' was executed, which began encrypting files. However, the encryption process was stopped by the EDR before all files were encrypted. The incident response team needs to determine the source of the infection and prevent future occurrences. Which of the following is the most effective first step to identify the initial infection vector?

Trap 1: Reimage all affected workstations to remove the ransomware and then…

Correct. Reimaging is remediation, but the key identification step is reviewing email logs to find the original phishing email that delivered 'invoice.docm'.

Trap 2: Block the external IP address at the firewall to prevent further…

Incorrect. Blocking the external IP is a containment step that prevents further C2 communication but does not identify the initial infection vector.

Trap 3: Disable PowerShell across all workstations via Group Policy to…

Incorrect. Disabling PowerShell is a containment/prevention measure that does not assist in identifying how the initial infection occurred.

Study all Cryptography and Malware Analysis common traps →

A
Reimage all affected workstations to remove the ransomware and then review email logs for the original phishing email.
Why wrong: Correct. Reimaging is remediation, but the key identification step is reviewing email logs to find the original phishing email that delivered 'invoice.docm'.
B
Block the external IP address at the firewall to prevent further communication with the C2 server.
Why wrong: Incorrect. Blocking the external IP is a containment step that prevents further C2 communication but does not identify the initial infection vector.
C
Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy.
Incorrect. Enabling macro security is a preventive measure that reduces future risk, but it does not help identify the source of the current infection.
D
Disable PowerShell across all workstations via Group Policy to prevent script execution.
Why wrong: Incorrect. Disabling PowerShell is a containment/prevention measure that does not assist in identifying how the initial infection occurred.

Full breakdown with real-world context →

Question 5mediumdrag order

Read the full wireless explanation →

Drag and drop the steps to configure a wireless network with WPA2-Enterprise authentication on a Cisco AP into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Create WLAN, then set up RADIUS server, then configure AP to use…

When creating a Wireless Local Area Network (WLAN) that relies on WPA2/3-Enterprise, the security configuration often requires specifying the RADIUS server's IP address and shared secret. Attempting to create the WLAN before the RADIUS server is set up means these critical authentication parameters are unknown or non-existent, leading to an incomplete or invalid WLAN definition. This sequence forces a placeholder or incorrect configuration initially, requiring subsequent modification to rectify.

Trap 2: Set up RADIUS server, then configure AP to use RADIUS, then create…

An Access Point (AP) is configured to use RADIUS specifically in the context of a defined Wireless Local Area Network (WLAN) or SSID. Configuring the AP for RADIUS authentication before the WLAN itself is created means the AP has no specific SSID to apply these authentication settings to. This creates a logical dependency issue, as the RADIUS configuration on the AP is typically tied directly to a WLAN profile, making this order inefficient or prone to configuration errors.

Trap 3: Set up RADIUS server, then create WLAN, then enable the WLAN, then…

Enabling the Wireless Local Area Network (WLAN) before the Access Point (AP) is configured to utilize the RADIUS server for authentication creates a significant security vulnerability. The WLAN would become active, potentially broadcasting its SSID, but without the WPA2/3-Enterprise security mechanism fully operational. Clients attempting to connect would either fail authentication or, in some misconfigurations, might connect without proper validation, thereby exposing the network to unauthorized access.

Study all Cryptography and Malware Analysis common traps →

A
Set up RADIUS server, then create WLAN, then configure AP to use RADIUS, then enable the WLAN, then test connectivity
This is the correct order because the RADIUS server must be operational before creating the WLAN that references it, and the AP must be configured to use RADIUS before enabling the WLAN to ensure authentication works. Finally, testing confirms functionality.
B
Create WLAN, then set up RADIUS server, then configure AP to use RADIUS, then enable the WLAN, then test connectivity
Why wrong: When creating a Wireless Local Area Network (WLAN) that relies on WPA2/3-Enterprise, the security configuration often requires specifying the RADIUS server's IP address and shared secret. Attempting to create the WLAN before the RADIUS server is set up means these critical authentication parameters are unknown or non-existent, leading to an incomplete or invalid WLAN definition. This sequence forces a placeholder or incorrect configuration initially, requiring subsequent modification to rectify.
C
Set up RADIUS server, then configure AP to use RADIUS, then create WLAN, then enable the WLAN, then test connectivity
Why wrong: An Access Point (AP) is configured to use RADIUS specifically in the context of a defined Wireless Local Area Network (WLAN) or SSID. Configuring the AP for RADIUS authentication before the WLAN itself is created means the AP has no specific SSID to apply these authentication settings to. This creates a logical dependency issue, as the RADIUS configuration on the AP is typically tied directly to a WLAN profile, making this order inefficient or prone to configuration errors.
D
Set up RADIUS server, then create WLAN, then enable the WLAN, then configure AP to use RADIUS, then test connectivity
Why wrong: Enabling the Wireless Local Area Network (WLAN) before the Access Point (AP) is configured to utilize the RADIUS server for authentication creates a significant security vulnerability. The WLAN would become active, potentially broadcasting its SSID, but without the WPA2/3-Enterprise security mechanism fully operational. Clients attempting to connect would either fail authentication or, in some misconfigurations, might connect without proper validation, thereby exposing the network to unauthorized access.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Cryptography and Malware Analysis explanation →

A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?

Trap 1: Nmap

Nmap (Network Mapper) is primarily used for network discovery and security auditing. It employs raw IP packets to determine hosts available on a network, their services, operating systems, and firewall status. While crucial for reconnaissance, Nmap does not possess any functionality to analyze a file's hash or query threat intelligence databases for malware detection. Therefore, it is unsuitable for investigating a suspicious file based on its cryptographic hash.

Trap 2: John the Ripper

John the Ripper is a free and open-source password cracking utility designed to detect weak Unix passwords and other types of credentials. It works by performing dictionary attacks, brute-force attacks, and other cryptographic attacks on password hashes. This tool's sole purpose is to recover passwords, not to analyze the characteristics or threat intelligence associated with a suspicious file's hash.

Trap 3: Wireshark

Wireshark is a powerful network protocol analyzer that allows users to interactively browse and inspect the data traveling on a computer network. It captures network traffic in real-time and displays it in a human-readable format, enabling deep inspection of individual packets. However, Wireshark's functionality is limited to network traffic analysis and does not include any features for submitting file hashes to threat intelligence platforms for malware identification.

Study all Cryptography and Malware Analysis common traps →

A
Nmap
Why wrong: Nmap (Network Mapper) is primarily used for network discovery and security auditing. It employs raw IP packets to determine hosts available on a network, their services, operating systems, and firewall status. While crucial for reconnaissance, Nmap does not possess any functionality to analyze a file's hash or query threat intelligence databases for malware detection. Therefore, it is unsuitable for investigating a suspicious file based on its cryptographic hash.
B
John the Ripper
Why wrong: John the Ripper is a free and open-source password cracking utility designed to detect weak Unix passwords and other types of credentials. It works by performing dictionary attacks, brute-force attacks, and other cryptographic attacks on password hashes. This tool's sole purpose is to recover passwords, not to analyze the characteristics or threat intelligence associated with a suspicious file's hash.
C
VirusTotal
VirusTotal is a web-based service that aggregates many antivirus products and online scan engines to check for viruses and other types of malicious content. A security analyst can submit a file's cryptographic hash (e.g., MD5, SHA1, SHA256) to VirusTotal, which then queries its extensive database and provides immediate detection results from numerous security vendors. This capability directly addresses the need to determine if a suspicious file is known malware by comparing its hash against a vast repository of threat intelligence.
D
Wireshark
Why wrong: Wireshark is a powerful network protocol analyzer that allows users to interactively browse and inspect the data traveling on a computer network. It captures network traffic in real-time and displays it in a human-readable format, enabling deep inspection of individual packets. However, Wireshark's functionality is limited to network traffic analysis and does not include any features for submitting file hashes to threat intelligence platforms for malware identification.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Cryptography and Malware Analysis explanation →

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

Trap 1: Weak TLS cipher suite

A weak TLS cipher suite would indicate a vulnerability in the cryptographic algorithms used for the transport layer (HTTPS) itself, potentially allowing an attacker to decrypt traffic in transit. However, the problem statement implies HTTPS is correctly implemented for secure transmission, meaning the issue lies beyond the integrity of the TLS handshake or the strength of its ciphers. The core problem is not about how data is transmitted securely, but what data is encrypted by the application before transmission or at rest, making this option incorrect.

Trap 2: SSL stripping attack

An SSL stripping attack, often executed via a Man-in-the-Middle (MITM) position, involves downgrading an HTTPS connection to an unencrypted HTTP connection, allowing the attacker to intercept plain-text traffic. The question does not provide any indicators of such an active downgrade attack, nor does it suggest that the connection itself was compromised to remove TLS. The scenario describes an issue where data remains unencrypted within the application context, despite an active HTTPS connection, making this option irrelevant.

Trap 3: Man-in-the-middle attack

A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and potentially altering the communication between two parties who believe they are directly communicating. While MITM attacks can target various protocols, HTTPS, when properly implemented with valid certificates, is designed to prevent such attacks by ensuring the authenticity of the server and the integrity and confidentiality of the data in transit. The problem described points to an application-level vulnerability, not a compromise of the secure transport channel itself, thus ruling out a MITM attack as the primary issue.

Study all Cryptography and Malware Analysis common traps →

A
Weak TLS cipher suite
Why wrong: A weak TLS cipher suite would indicate a vulnerability in the cryptographic algorithms used for the transport layer (HTTPS) itself, potentially allowing an attacker to decrypt traffic in transit. However, the problem statement implies HTTPS is correctly implemented for secure transmission, meaning the issue lies beyond the integrity of the TLS handshake or the strength of its ciphers. The core problem is not about how data is transmitted securely, but what data is encrypted by the application before transmission or at rest, making this option incorrect.
B
Lack of application-layer encryption
This is the correct answer because while HTTPS encrypts data in transit between the client and server, it does not inherently encrypt data at the application layer before it is sent or when it is stored. If sensitive fields are not encrypted by the application itself, they could be exposed in memory, logs, or databases on the server side, even if the network communication is secure. The application's failure to encrypt sensitive data before processing or storage creates a vulnerability independent of transport security.
C
SSL stripping attack
Why wrong: An SSL stripping attack, often executed via a Man-in-the-Middle (MITM) position, involves downgrading an HTTPS connection to an unencrypted HTTP connection, allowing the attacker to intercept plain-text traffic. The question does not provide any indicators of such an active downgrade attack, nor does it suggest that the connection itself was compromised to remove TLS. The scenario describes an issue where data remains unencrypted within the application context, despite an active HTTPS connection, making this option irrelevant.
D
Man-in-the-middle attack
Why wrong: A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and potentially altering the communication between two parties who believe they are directly communicating. While MITM attacks can target various protocols, HTTPS, when properly implemented with valid certificates, is designed to prevent such attacks by ensuring the authenticity of the server and the integrity and confidentiality of the data in transit. The problem described points to an application-level vulnerability, not a compromise of the secure transport channel itself, thus ruling out a MITM attack as the primary issue.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Cryptography and Malware Analysis explanation →

A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?

Trap 1: The CRL published by the certificate authority that signed the…

The certificate authority that signed the issuing CA's certificate is the root CA in a two-tier PKI. While the root CA establishes the chain of trust, its Certificate Revocation List (CRL) primarily contains information about revoked subordinate CA certificates, not the end-entity certificates issued by those subordinate CAs. Therefore, checking the root CA's CRL would not provide the necessary revocation status for an end-entity certificate issued by the online CA.

Trap 2: The CRL published by the intermediate CA, if any

The question explicitly describes a two-tier Public Key Infrastructure (PKI) with an offline root CA and an online issuing CA. There is no mention or implication of an intermediate CA in this specific scenario. While an intermediate CA would publish its own CRL for certificates it issues, its absence from the described architecture means its CRL is not relevant for determining the revocation status of certificates issued by the designated online issuing CA.

Trap 3: The CRL published by the offline root CA

The offline root CA, being the trust anchor, is primarily responsible for signing the certificates of its subordinate CAs, such as the online issuing CA in this setup. It does not directly issue end-entity certificates to users or devices. Therefore, its Certificate Revocation List (CRL) would only contain information about revoked CA certificates that it signed, not the end-entity certificates issued by its subordinate online CA.

Study all Cryptography and Malware Analysis common traps →

A
The CRL published by the certificate authority that signed the issuing CA's certificate
Why wrong: The certificate authority that signed the issuing CA's certificate is the root CA in a two-tier PKI. While the root CA establishes the chain of trust, its Certificate Revocation List (CRL) primarily contains information about revoked subordinate CA certificates, not the end-entity certificates issued by those subordinate CAs. Therefore, checking the root CA's CRL would not provide the necessary revocation status for an end-entity certificate issued by the online CA.
B
The CRL published by the intermediate CA, if any
Why wrong: The question explicitly describes a two-tier Public Key Infrastructure (PKI) with an offline root CA and an online issuing CA. There is no mention or implication of an intermediate CA in this specific scenario. While an intermediate CA would publish its own CRL for certificates it issues, its absence from the described architecture means its CRL is not relevant for determining the revocation status of certificates issued by the designated online issuing CA.
C
The CRL published by the online issuing CA
The online issuing CA is directly responsible for generating, signing, and managing the lifecycle of end-entity certificates within this PKI. When an end-entity certificate needs to be revoked, it is the issuing CA that records this revocation event and publishes it in its own Certificate Revocation List (CRL). Consequently, clients validating an end-entity certificate must consult the CRL published by the online issuing CA to ascertain its current revocation status.
D
The CRL published by the offline root CA
Why wrong: The offline root CA, being the trust anchor, is primarily responsible for signing the certificates of its subordinate CAs, such as the online issuing CA in this setup. It does not directly issue end-entity certificates to users or devices. Therefore, its Certificate Revocation List (CRL) would only contain information about revoked CA certificates that it signed, not the end-entity certificates issued by its subordinate online CA.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Cryptography and Malware Analysis explanation →

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

Trap 1: Check running processes for suspicious entries

Hardware keyloggers operate at a physical layer, intercepting keystrokes between the keyboard and the computer's input port before they are processed by the operating system. Consequently, these devices do not execute as software processes within the operating system's memory space. Checking running processes would only reveal software-based malware or legitimate applications, rendering this method entirely ineffective for detecting a physical keylogger.

Trap 2: Review USB device history in Event Viewer

While Event Viewer can log the connection of new USB devices, many sophisticated hardware keyloggers are designed to operate transparently, often mimicking the original keyboard's device ID or functioning as a pass-through device. This stealth capability means they may not generate distinct, suspicious entries in the USB device history that would clearly indicate a malicious device. Therefore, relying solely on Event Viewer logs is insufficient for definitive detection.

Trap 3: Run an antivirus scan

Antivirus software is specifically engineered to detect, quarantine, and remove malicious software components, such as viruses, worms, and software-based keyloggers, by scanning files and monitoring system behavior. Hardware keyloggers, however, are standalone physical devices that do not install files on the system or execute code within the operating system. An antivirus scan would therefore completely overlook such a device, as it operates outside the scope of software-level detection.

Study all Cryptography and Malware Analysis common traps →

A
Check running processes for suspicious entries
Why wrong: Hardware keyloggers operate at a physical layer, intercepting keystrokes between the keyboard and the computer's input port before they are processed by the operating system. Consequently, these devices do not execute as software processes within the operating system's memory space. Checking running processes would only reveal software-based malware or legitimate applications, rendering this method entirely ineffective for detecting a physical keylogger.
B
Physically inspect the connection between the keyboard and the computer
Hardware keyloggers are physical devices designed to be inconspicuous, often resembling a standard cable adapter or a small inline dongle. They are typically inserted directly between the keyboard's cable and the computer's keyboard port (e.g., USB or PS/2). A direct physical examination of this connection point is the most reliable and often the only method to visually identify and remove such a device, as it bypasses all software-based detection limitations.
C
Review USB device history in Event Viewer
Why wrong: While Event Viewer can log the connection of new USB devices, many sophisticated hardware keyloggers are designed to operate transparently, often mimicking the original keyboard's device ID or functioning as a pass-through device. This stealth capability means they may not generate distinct, suspicious entries in the USB device history that would clearly indicate a malicious device. Therefore, relying solely on Event Viewer logs is insufficient for definitive detection.
D
Run an antivirus scan
Why wrong: Antivirus software is specifically engineered to detect, quarantine, and remove malicious software components, such as viruses, worms, and software-based keyloggers, by scanning files and monitoring system behavior. Hardware keyloggers, however, are standalone physical devices that do not install files on the system or execute code within the operating system. An antivirus scan would therefore completely overlook such a device, as it operates outside the scope of software-level detection.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Cryptography and Malware Analysis explanation →

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

Trap 1: GCM

Galois/Counter Mode (GCM) is an authenticated encryption mode that combines confidentiality with data integrity and authenticity. While it uses a counter mode for encryption, its defining feature is the generation and appending of an authentication tag to the ciphertext. This tag, crucial for verifying data integrity and authenticity, inherently increases the overall length of the transmitted data beyond just the padded plaintext, making it unsuitable when minimal length increase is the primary concern.

Trap 2: CFB

Cipher Feedback (CFB) mode operates as a stream cipher, generating a keystream that is XORed with the plaintext. While it can produce ciphertext of the same length as the plaintext, it requires a unique Initialization Vector (IV) for each encryption operation to ensure semantic security and prevent identical plaintexts from yielding identical ciphertexts. This IV, though not part of the ciphertext blocks themselves, is an essential additional piece of data that must be transmitted or derived, contributing to the overall data overhead.

Trap 3: CBC

Cipher Block Chaining (CBC) mode enhances security by XORing each plaintext block with the previous ciphertext block before encryption, creating a dependency chain. For the first block, and to ensure unique ciphertexts for identical plaintexts, CBC mode mandates the use of a unique Initialization Vector (IV). This IV is a critical component for decryption and is typically transmitted alongside the ciphertext, thereby adding to the total data length beyond the encrypted blocks themselves.

Study all Cryptography and Malware Analysis common traps →

A
GCM
Why wrong: Galois/Counter Mode (GCM) is an authenticated encryption mode that combines confidentiality with data integrity and authenticity. While it uses a counter mode for encryption, its defining feature is the generation and appending of an authentication tag to the ciphertext. This tag, crucial for verifying data integrity and authenticity, inherently increases the overall length of the transmitted data beyond just the padded plaintext, making it unsuitable when minimal length increase is the primary concern.
B
CFB
Why wrong: Cipher Feedback (CFB) mode operates as a stream cipher, generating a keystream that is XORed with the plaintext. While it can produce ciphertext of the same length as the plaintext, it requires a unique Initialization Vector (IV) for each encryption operation to ensure semantic security and prevent identical plaintexts from yielding identical ciphertexts. This IV, though not part of the ciphertext blocks themselves, is an essential additional piece of data that must be transmitted or derived, contributing to the overall data overhead.
C
ECB
Electronic Codebook (ECB) mode encrypts each fixed-size block of plaintext independently using the same secret key. It does not employ any chaining mechanism between blocks, nor does it require an Initialization Vector (IV) or nonce. The only potential increase in data length results from padding the final plaintext block to meet the cipher's block size, making it the mode that introduces the absolute minimum cryptographic overhead and data expansion.
D
CBC
Why wrong: Cipher Block Chaining (CBC) mode enhances security by XORing each plaintext block with the previous ciphertext block before encryption, creating a dependency chain. For the first block, and to ensure unique ciphertexts for identical plaintexts, CBC mode mandates the use of a unique Initialization Vector (IV). This IV is a critical component for decryption and is typically transmitted alongside the ciphertext, thereby adding to the total data length beyond the encrypted blocks themselves.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Cryptography and Malware Analysis explanation →

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

Trap 1: Code obfuscation

Code obfuscation is a technique employed by malware authors to make their code difficult for human analysts and automated tools to understand and reverse engineer. This is achieved through methods like junk code insertion, control flow flattening, string encryption, or renaming variables. Its primary goal is to hinder static analysis and intellectual property theft, not to detect the characteristics of a virtualized environment or sandbox by querying system resource counts.

Trap 2: Anti-debugging

Anti-debugging techniques are specifically designed to detect the presence of a debugger attached to a process or to impede its functionality. Malware uses these methods, such as checking for debugger-specific API calls, timing anomalies, or process environment block flags, to prevent dynamic analysis. While critical for evading real-time inspection, anti-debugging does not typically involve querying system hardware resources like CPU cores or memory size to identify a virtual machine or sandbox environment.

Trap 3: Packing

Packing involves compressing or encrypting an executable's original code and data, typically to reduce its size and evade static signature-based detection by antivirus software. The packed executable contains a small stub that unpacks the original code into memory at runtime before execution. This technique primarily targets file-based detection and does not involve querying system resource attributes like CPU or memory to identify a virtual machine or sandbox environment; its focus is on altering the file's static signature.

Study all Cryptography and Malware Analysis common traps →

A
Code obfuscation
Why wrong: Code obfuscation is a technique employed by malware authors to make their code difficult for human analysts and automated tools to understand and reverse engineer. This is achieved through methods like junk code insertion, control flow flattening, string encryption, or renaming variables. Its primary goal is to hinder static analysis and intellectual property theft, not to detect the characteristics of a virtualized environment or sandbox by querying system resource counts.
B
Anti-debugging
Why wrong: Anti-debugging techniques are specifically designed to detect the presence of a debugger attached to a process or to impede its functionality. Malware uses these methods, such as checking for debugger-specific API calls, timing anomalies, or process environment block flags, to prevent dynamic analysis. While critical for evading real-time inspection, anti-debugging does not typically involve querying system hardware resources like CPU cores or memory size to identify a virtual machine or sandbox environment.
C
Anti-VM / sandbox evasion
Anti-VM and sandbox evasion techniques are employed by malware to determine if it is executing within a virtualized environment or an automated analysis sandbox, which often have deliberately limited resources. Checking for low CPU core counts, minimal RAM, small disk sizes, or generic hardware identifiers are common heuristics used by malware to detect these environments. If such conditions are met, the malware may alter its behavior, remain dormant, or self-terminate to avoid detection and analysis, thus preserving its efficacy.
D
Packing
Why wrong: Packing involves compressing or encrypting an executable's original code and data, typically to reduce its size and evade static signature-based detection by antivirus software. The packed executable contains a small stub that unpacks the original code into memory at runtime before execution. This technique primarily targets file-based detection and does not involve querying system resource attributes like CPU or memory to identify a virtual machine or sandbox environment; its focus is on altering the file's static signature.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Cryptography and Malware Analysis explanation →

A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?

Trap 1: Sender's public key

The sender's public key is designed for distribution and is used by recipients to verify the digital signature, not to create it. If a sender were to sign with their public key, anyone with access to that public key could forge a signature, completely undermining the non-repudiation and authenticity guarantees that digital signatures provide. This key's function is to confirm the private key's action, not to perform it.

Trap 2: Recipient's private key

The recipient's private key is exclusively used by the recipient to decrypt messages that have been encrypted specifically for them using their corresponding public key. It plays no role in the sender's process of creating a digital signature, as the signature's purpose is to authenticate the sender and ensure message integrity, not to secure the message's confidentiality for the recipient.

Trap 3: Recipient's public key

The recipient's public key is primarily utilized by the sender to encrypt the email message, ensuring confidentiality so that only the intended recipient can decrypt and read it. While crucial for secure communication, this key is not involved in the digital signing process, which focuses on authenticating the sender and verifying message integrity, not on encrypting the content itself.

Study all Cryptography and Malware Analysis common traps →

A
Sender's public key
Why wrong: The sender's public key is designed for distribution and is used by recipients to verify the digital signature, not to create it. If a sender were to sign with their public key, anyone with access to that public key could forge a signature, completely undermining the non-repudiation and authenticity guarantees that digital signatures provide. This key's function is to confirm the private key's action, not to perform it.
B
Sender's private key
The sender's private key is the correct cryptographic component used to create a digital signature. This unique, secret key is applied to a hash of the email content, producing a signature that proves the sender's identity and ensures message integrity. Only the legitimate sender possesses this key, thereby providing non-repudiation and guaranteeing authenticity to the recipient.
C
Recipient's private key
Why wrong: The recipient's private key is exclusively used by the recipient to decrypt messages that have been encrypted specifically for them using their corresponding public key. It plays no role in the sender's process of creating a digital signature, as the signature's purpose is to authenticate the sender and ensure message integrity, not to secure the message's confidentiality for the recipient.
D
Recipient's public key
Why wrong: The recipient's public key is primarily utilized by the sender to encrypt the email message, ensuring confidentiality so that only the intended recipient can decrypt and read it. While crucial for secure communication, this key is not involved in the digital signing process, which focuses on authenticating the sender and verifying message integrity, not on encrypting the content itself.

Full breakdown with real-world context →

Question 13easymulti select

Read the full Cryptography and Malware Analysis explanation →

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Trap 1: Remains constant in code to ensure replication

A core characteristic of polymorphic viruses is their ability to alter their internal structure. Therefore, remaining constant in code directly contradicts the definition of polymorphism, which involves continuous mutation. Such a static code pattern would render the virus easily detectable by signature-based antivirus solutions, failing to achieve its primary objective of stealth and persistence. This constancy would be a fatal flaw for a polymorphic threat.

Trap 2: Spreads via network shares

While some malware, including certain polymorphic variants, might leverage network shares for propagation, spreading via network shares is a characteristic of malware delivery mechanisms or worm-like behavior, not an inherent defining trait of polymorphism itself. Polymorphism describes how a virus changes its code, irrespective of its specific method of initial infection or lateral movement within a network. Worms are particularly known for this self-propagating capability.

Trap 3: Resides in the boot sector of a hard drive

Residing in the boot sector is a specific infection location characteristic, defining a category known as boot sector viruses. This describes where the malware physically stores itself and executes upon system startup, rather than how its code behaves or changes. Polymorphism, in contrast, refers to the virus's ability to alter its own code structure, which can be implemented by various types of malware, including those that might or might not infect the boot sector.

Study all Cryptography and Malware Analysis common traps →

A
Remains constant in code to ensure replication
Why wrong: A core characteristic of polymorphic viruses is their ability to alter their internal structure. Therefore, remaining constant in code directly contradicts the definition of polymorphism, which involves continuous mutation. Such a static code pattern would render the virus easily detectable by signature-based antivirus solutions, failing to achieve its primary objective of stealth and persistence. This constancy would be a fatal flaw for a polymorphic threat.
B
Mutates its code to evade signature detection
Polymorphic viruses are specifically designed with a mutation engine that generates a different, functionally identical variant of the virus body with each replication. This constant alteration of their code signature, including instruction sequences and encryption routines, makes it extremely challenging for traditional signature-based antivirus software to identify and block them. The primary goal of this mutation is to bypass detection mechanisms that rely on fixed patterns.
C
Uses encryption with a variable key
Many polymorphic viruses employ encryption to conceal their malicious payload, with a small decryption routine preceding the encrypted body. Crucially, they utilize a variable encryption key that changes with each infection instance, ensuring that the encrypted virus body appears different every time. This technique, combined with a mutating decryption routine, further complicates signature generation and detection by security software.
D
Spreads via network shares
Why wrong: While some malware, including certain polymorphic variants, might leverage network shares for propagation, spreading via network shares is a characteristic of malware delivery mechanisms or worm-like behavior, not an inherent defining trait of polymorphism itself. Polymorphism describes how a virus changes its code, irrespective of its specific method of initial infection or lateral movement within a network. Worms are particularly known for this self-propagating capability.
E
Resides in the boot sector of a hard drive
Why wrong: Residing in the boot sector is a specific infection location characteristic, defining a category known as boot sector viruses. This describes where the malware physically stores itself and executes upon system startup, rather than how its code behaves or changes. Polymorphism, in contrast, refers to the virus's ability to alter its own code structure, which can be implemented by various types of malware, including those that might or might not infect the boot sector.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full Cryptography and Malware Analysis explanation →

You are a security analyst for a medium-sized company. The company uses a custom web application for internal project management. The application uses AES-256-CBC for encrypting sensitive data stored in the database. Recently, the company experienced a data breach where an attacker exfiltrated the entire database. Although the data was encrypted, the attacker was able to decrypt some records. Investigation reveals that the encryption key is stored in a configuration file on the same server, and the initialization vector (IV) is hardcoded in the application code. Additionally, the application uses the same key for all records. Which of the following is the most effective remediation to prevent future decryption of stolen encrypted data?

Trap 1: Change the encryption mode from CBC to GCM to provide authentication

Changing to GCM mode provides authenticated encryption, offering both confidentiality and integrity, which is an improvement over CBC alone. However, if the same encryption key is reused across multiple records, a compromise of that single key would still allow an attacker to decrypt and potentially tamper with all records encrypted with it. GCM does not inherently solve the fundamental problem of widespread data exposure resulting from a single key's compromise when that key is applied universally.

Trap 2: Store the encryption key in a hardware security module (HSM) and…

While storing the encryption key in a Hardware Security Module (HSM) significantly enhances the security of the key itself by protecting it from extraction and unauthorized access, it does not mitigate the risk if the *same key* is used for *all* records. Should this single key ever be compromised, whether through a sophisticated attack on the HSM's operational interface or a flaw in the application's key usage, every record encrypted with it would become vulnerable. The issue lies in the scope of impact from a single key's compromise, not solely its storage location.

Trap 3: Rotate the encryption key every 24 hours

Key rotation is a valuable security practice that limits the amount of data encrypted with any single key and reduces the window of opportunity for an attacker to exploit a compromised key. However, it primarily protects *new* data encrypted with the freshly rotated key. If an *old* key is compromised, all records previously encrypted with that specific key remain vulnerable to decryption, regardless of subsequent key rotations. This approach fails to limit the 'blast radius' of a key compromise on existing, historical data.

Study all Cryptography and Malware Analysis common traps →

A
Change the encryption mode from CBC to GCM to provide authentication
Why wrong: Changing to GCM mode provides authenticated encryption, offering both confidentiality and integrity, which is an improvement over CBC alone. However, if the same encryption key is reused across multiple records, a compromise of that single key would still allow an attacker to decrypt and potentially tamper with all records encrypted with it. GCM does not inherently solve the fundamental problem of widespread data exposure resulting from a single key's compromise when that key is applied universally.
B
Store the encryption key in a hardware security module (HSM) and use the same key
Why wrong: While storing the encryption key in a Hardware Security Module (HSM) significantly enhances the security of the key itself by protecting it from extraction and unauthorized access, it does not mitigate the risk if the *same key* is used for *all* records. Should this single key ever be compromised, whether through a sophisticated attack on the HSM's operational interface or a flaw in the application's key usage, every record encrypted with it would become vulnerable. The issue lies in the scope of impact from a single key's compromise, not solely its storage location.
C
Rotate the encryption key every 24 hours
Why wrong: Key rotation is a valuable security practice that limits the amount of data encrypted with any single key and reduces the window of opportunity for an attacker to exploit a compromised key. However, it primarily protects *new* data encrypted with the freshly rotated key. If an *old* key is compromised, all records previously encrypted with that specific key remain vulnerable to decryption, regardless of subsequent key rotations. This approach fails to limit the 'blast radius' of a key compromise on existing, historical data.
D
Implement per-record encryption keys derived from a master key combined with a unique salt
Implementing per-record encryption keys derived from a master key combined with a unique salt is the most robust solution. This method ensures that each individual record is encrypted with a distinct, cryptographically unique key generated using a Key Derivation Function (KDF). Consequently, if one derived record key is ever compromised, only that specific record is affected, leaving all other records protected by their respective unique keys and the secure master key. This significantly limits the impact of any single key compromise, enhancing overall data security.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Cryptography and Malware Analysis explanation →

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

Exhibit

Refer to the exhibit.

---
C:\> certutil -hashfile C:\Users\Admin\Downloads\update.exe SHA256
SHA256 hash of C:\Users\Admin\Downloads\update.exe:
4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f
---

Trap 1: The file has been tampered with because the hash is from a…

This statement is incorrect. If the calculated cryptographic hash of the downloaded file precisely matches the officially provided hash, it confirms that the file's contents are identical to the original source. A mismatch would indeed indicate tampering or corruption, but in this scenario, the hashes align, unequivocally verifying the file's integrity and authenticity, not a different file.

Trap 2: The SHA256 hash is not reliable; the analyst should use MD5 instead.

This assertion is fundamentally flawed. SHA256 is a cryptographically robust hashing algorithm, offering significantly stronger collision resistance and security compared to MD5. MD5 has known vulnerabilities, making it unsuitable for security-critical integrity checks where malicious collisions could be engineered. Therefore, SHA256 is the preferred and reliable choice for verifying file integrity, not MD5.

Trap 3: The file is malicious because the hash is too long.

This conclusion is incorrect. The length of a cryptographic hash is determined solely by the specific hashing algorithm used (e.g., SHA256 produces a 256-bit output, which is 64 hexadecimal characters long) and bears no relation to whether a file is malicious. A hash's primary purpose is integrity verification; if it matches the expected value, it indicates integrity, not maliciousness or benignness based on its length.

Study all Cryptography and Malware Analysis common traps →

A
The file has been tampered with because the hash is from a different file.
Why wrong: This statement is incorrect. If the calculated cryptographic hash of the downloaded file precisely matches the officially provided hash, it confirms that the file's contents are identical to the original source. A mismatch would indeed indicate tampering or corruption, but in this scenario, the hashes align, unequivocally verifying the file's integrity and authenticity, not a different file.
B
The SHA256 hash is not reliable; the analyst should use MD5 instead.
Why wrong: This assertion is fundamentally flawed. SHA256 is a cryptographically robust hashing algorithm, offering significantly stronger collision resistance and security compared to MD5. MD5 has known vulnerabilities, making it unsuitable for security-critical integrity checks where malicious collisions could be engineered. Therefore, SHA256 is the preferred and reliable choice for verifying file integrity, not MD5.
C
The file is authentic and has not been tampered with.
This statement is correct. When the cryptographic hash (e.g., SHA256) calculated from a downloaded file precisely matches the official, published hash value, it provides strong cryptographic assurance. This match confirms that the file's contents are identical to the original source and have not been altered, corrupted, or tampered with during transit or storage, thereby establishing its authenticity and integrity.
D
The file is malicious because the hash is too long.
Why wrong: This conclusion is incorrect. The length of a cryptographic hash is determined solely by the specific hashing algorithm used (e.g., SHA256 produces a 256-bit output, which is 64 hexadecimal characters long) and bears no relation to whether a file is malicious. A hash's primary purpose is integrity verification; if it matches the expected value, it indicates integrity, not maliciousness or benignness based on its length.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full Cryptography and Malware Analysis explanation →

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

Trap 1: Implement password hashing with bcrypt on the server side.

Implementing password hashing with bcrypt on the server side is a critical security measure for protecting stored credentials against database breaches. However, this process occurs *after* the password has been transmitted from the client to the server. Therefore, hashing does not protect the password during its journey across the network, leaving it vulnerable to interception in cleartext if the communication channel itself is not encrypted.

Trap 2: Use digital signatures to sign the login request.

Digital signatures provide authenticity and integrity for a login request, ensuring that the request originated from a legitimate source and has not been tampered with during transit. Nevertheless, digital signatures do not encrypt the content of the request. An attacker intercepting a signed request would still be able to read the plaintext username and password, as the signature only validates the data, it does not obscure it.

Trap 3: Encrypt the password field using AES-256 before sending via HTTP.

Encrypting only the password field using AES-256 before sending it via plain HTTP is an incomplete and insecure approach. While AES-256 provides strong encryption for the password itself, the critical challenge lies in securely distributing the encryption key to the client without an already established secure channel. Additionally, other sensitive information within the HTTP request would remain unencrypted and susceptible to interception, compromising overall session security.

Study all Cryptography and Malware Analysis common traps →

A
Implement password hashing with bcrypt on the server side.
Why wrong: Implementing password hashing with bcrypt on the server side is a critical security measure for protecting stored credentials against database breaches. However, this process occurs *after* the password has been transmitted from the client to the server. Therefore, hashing does not protect the password during its journey across the network, leaving it vulnerable to interception in cleartext if the communication channel itself is not encrypted.
B
Use digital signatures to sign the login request.
Why wrong: Digital signatures provide authenticity and integrity for a login request, ensuring that the request originated from a legitimate source and has not been tampered with during transit. Nevertheless, digital signatures do not encrypt the content of the request. An attacker intercepting a signed request would still be able to read the plaintext username and password, as the signature only validates the data, it does not obscure it.
C
Enforce HTTPS using TLS 1.2 or higher.
Enforcing HTTPS using TLS 1.2 or higher is the most effective solution for protecting credentials during transmission. TLS establishes an encrypted tunnel between the client and the server, ensuring confidentiality, integrity, and authenticity for all data exchanged, including login credentials. This robust encryption prevents eavesdropping, tampering, and man-in-the-middle attacks by encrypting the entire communication channel end-to-end.
D
Encrypt the password field using AES-256 before sending via HTTP.
Why wrong: Encrypting only the password field using AES-256 before sending it via plain HTTP is an incomplete and insecure approach. While AES-256 provides strong encryption for the password itself, the critical challenge lies in securely distributing the encryption key to the client without an already established secure channel. Additionally, other sensitive information within the HTTP request would remain unencrypted and susceptible to interception, compromising overall session security.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full Cryptography and Malware Analysis explanation →

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

Trap 1: Diffie-Hellman (DH) key exchange

Standard Diffie-Hellman alone negotiates a shared secret without any server authentication, so it cannot establish a trusted HTTPS session because it lacks a mechanism to bind the key exchange to the server’s certificate. It is tempting because DH does provide ephemeral keying for PFS when combined with signatures (as in DHE), but the plain DH mode is actually intended for anonymous key agreement where authentication is handled separately or not required.

Trap 2: Pre-Shared Key (PSK)

Pre-Shared Key (PSK) key exchange is generally unsuitable for public web servers due to significant scalability and key management challenges, as each client would need to share a unique secret with the server beforehand. Furthermore, PSK does not inherently provide Perfect Forward Secrecy (PFS); if the pre-shared key is ever compromised, all past and future communications encrypted with that key become vulnerable to decryption. Its primary applications are typically in closed environments like VPNs or IoT devices where key distribution can be tightly controlled.

Trap 3: RSA key exchange

RSA key exchange, while historically common, does not offer Perfect Forward Secrecy (PFS), making it an insecure choice for modern web servers. In this method, the client encrypts a pre-master secret using the server's static public RSA key, which the server then decrypts with its corresponding private key. Consequently, if the server's long-term private key is ever compromised, an attacker can retroactively decrypt all past recorded TLS sessions that used this key exchange mechanism, completely undermining confidentiality.

Study all Cryptography and Malware Analysis common traps →

A
Diffie-Hellman (DH) key exchange
Why wrong: Standard Diffie-Hellman alone negotiates a shared secret without any server authentication, so it cannot establish a trusted HTTPS session because it lacks a mechanism to bind the key exchange to the server’s certificate. It is tempting because DH does provide ephemeral keying for PFS when combined with signatures (as in DHE), but the plain DH mode is actually intended for anonymous key agreement where authentication is handled separately or not required.
B
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) is the correct choice because it provides Perfect Forward Secrecy (PFS) by generating unique, ephemeral session keys for each TLS handshake. This means that even if the server's long-term private key is compromised in the future, an attacker cannot decrypt previously recorded sessions. The ephemeral keys are derived using elliptic curve cryptography, offering strong security with smaller key sizes and faster computations compared to traditional Diffie-Hellman, making it ideal for web servers.
C
Pre-Shared Key (PSK)
Why wrong: Pre-Shared Key (PSK) key exchange is generally unsuitable for public web servers due to significant scalability and key management challenges, as each client would need to share a unique secret with the server beforehand. Furthermore, PSK does not inherently provide Perfect Forward Secrecy (PFS); if the pre-shared key is ever compromised, all past and future communications encrypted with that key become vulnerable to decryption. Its primary applications are typically in closed environments like VPNs or IoT devices where key distribution can be tightly controlled.
D
RSA key exchange
Why wrong: RSA key exchange, while historically common, does not offer Perfect Forward Secrecy (PFS), making it an insecure choice for modern web servers. In this method, the client encrypts a pre-master secret using the server's static public RSA key, which the server then decrypts with its corresponding private key. Consequently, if the server's long-term private key is ever compromised, an attacker can retroactively decrypt all past recorded TLS sessions that used this key exchange mechanism, completely undermining confidentiality.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Cryptography and Malware Analysis explanation →

You are a security analyst at a financial institution. The SOC has detected anomalous outbound traffic from a server in the DMZ to an unknown IP address on TCP port 8443. The server runs a custom application that normally communicates with internal databases on port 1433. The server's OS is Windows Server 2019. Preliminary analysis shows that a new service named 'UpdateSvc' was installed three days ago, set to start automatically, and runs under the LocalSystem account. The service binary is located at C:\Windows\System32\svchost.exe (the legitimate one). However, the service's 'ImagePath' registry key points to 'C:\Windows\System32\svchost.exe -k UpdateSvc'. Additionally, a scheduled task named 'HealthCheck' runs every hour and executes 'powershell.exe -EncodedCommand <base64>'. The encoded command decodes to a script that downloads a payload from the same unknown IP on port 8443 and executes it in memory. The server has antivirus installed that detected nothing. As the analyst, which of the following is the BEST immediate course of action?

Trap 1: Reimage the server immediately to ensure the malware is completely…

Reimaging a server immediately, while effective for malware removal, is a highly destructive action that obliterates crucial forensic artifacts. This includes memory dumps, registry keys, log files, and temporary files that could reveal the malware's origin, capabilities, and exfiltration targets. This premature action prevents a thorough root cause analysis and understanding the full scope of the breach, prioritizing eradication over essential containment and investigation phases.

Trap 2: Uninstall the current antivirus and install a different endpoint…

Uninstalling and reinstalling endpoint protection is a time-consuming process that leaves the compromised server vulnerable during the transition period. More critically, this action fails to immediately stop active malicious processes, such as ongoing data exfiltration or lateral movement, which could continue unimpeded while the new solution is being deployed and scanned. The primary concern in an active compromise is immediate containment, which this approach does not address effectively or promptly.

Trap 3: Delete the 'UpdateSvc' service and the 'HealthCheck' scheduled…

Directly deleting identified persistence mechanisms like services and scheduled tasks, while seemingly proactive, risks destroying valuable forensic evidence about the malware's configuration and capabilities. Furthermore, sophisticated malware often employs multiple, redundant persistence methods, meaning removing just these two might not fully eradicate the threat and could leave other backdoors active. A full antivirus scan alone might also miss advanced, fileless, or polymorphic malware, making this a potentially incomplete and evidence-destroying approach.

Study all Cryptography and Malware Analysis common traps →

A
Reimage the server immediately to ensure the malware is completely removed.
Why wrong: Reimaging a server immediately, while effective for malware removal, is a highly destructive action that obliterates crucial forensic artifacts. This includes memory dumps, registry keys, log files, and temporary files that could reveal the malware's origin, capabilities, and exfiltration targets. This premature action prevents a thorough root cause analysis and understanding the full scope of the breach, prioritizing eradication over essential containment and investigation phases.
B
Uninstall the current antivirus and install a different endpoint protection solution, then perform a full scan.
Why wrong: Uninstalling and reinstalling endpoint protection is a time-consuming process that leaves the compromised server vulnerable during the transition period. More critically, this action fails to immediately stop active malicious processes, such as ongoing data exfiltration or lateral movement, which could continue unimpeded while the new solution is being deployed and scanned. The primary concern in an active compromise is immediate containment, which this approach does not address effectively or promptly.
C
Delete the 'UpdateSvc' service and the 'HealthCheck' scheduled task, then run a full antivirus scan.
Why wrong: Directly deleting identified persistence mechanisms like services and scheduled tasks, while seemingly proactive, risks destroying valuable forensic evidence about the malware's configuration and capabilities. Furthermore, sophisticated malware often employs multiple, redundant persistence methods, meaning removing just these two might not fully eradicate the threat and could leave other backdoors active. A full antivirus scan alone might also miss advanced, fileless, or polymorphic malware, making this a potentially incomplete and evidence-destroying approach.
D
Isolate the server from the network by disconnecting the network cable and blocking the IP at the firewall, then initiate incident response procedures.
Isolating the compromised server is the critical first step in containing an active security incident. Disconnecting the network cable physically severs all external and internal network communication, immediately halting data exfiltration, command-and-control (C2) communications, and preventing lateral movement to other systems. Blocking the IP at the firewall provides an additional layer of network-level containment. This action preserves the system's state for forensic analysis while stopping the immediate threat, allowing for a structured incident response process to follow.

Full breakdown with real-world context →

Question 19hardmulti select

Read the full Cryptography and Malware Analysis explanation →

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Trap 1: volatility -f memory.dmp procdump

The `volatility -f memory.dmp procdump` command is used to extract the executable image or memory regions of a *specific* process from the dump. While invaluable for subsequent in-depth analysis, such as reverse engineering or string extraction from a known malicious process, it requires the investigator to first identify the suspicious process's PID. Therefore, it is not an initial detection tool for broadly identifying an infection but rather a targeted analysis step performed after initial indicators have been found.

Trap 2: volatility -f memory.dmp svcscan

The `volatility -f memory.dmp svcscan` command enumerates all registered Windows services and their current states within the memory dump. While some malware achieves persistence by installing itself as a service, many infections operate as userland processes or inject into existing ones without creating new services. Consequently, `svcscan` is less direct for initial detection of active malware behavior compared to analyzing running processes or network connections, which are more immediate indicators of compromise.

Trap 3: volatility -f memory.dmp malfind

The `volatility -f memory.dmp malfind` command is designed to detect hidden or injected code within process memory, often indicative of advanced malware techniques like process injection or rootkit functionality. While extremely powerful for confirming sophisticated infections, it focuses on memory regions rather than providing an initial overview of all running processes or active network connections. It is a more specialized detection mechanism, typically employed after initial indicators suggest a process might be compromised.

Study all Cryptography and Malware Analysis common traps →

A
volatility -f memory.dmp netscan
The `volatility -f memory.dmp netscan` command is crucial for initial malware investigation because it enumerates all active network connections present in the memory dump. This allows incident responders to quickly identify suspicious outbound connections to unknown or malicious IP addresses, which are strong indicators of command and control (C2) communication, data exfiltration, or botnet activity. Confirming such network activity is a primary step in validating a potential infection.
B
volatility -f memory.dmp pslist
The `volatility -f memory.dmp pslist` command is fundamental for initial malware detection as it provides a comprehensive list of all running processes within the memory image. By examining process names, PIDs, parent PIDs, and execution times, investigators can identify unusual processes, processes running from non-standard locations, or processes with suspicious parent-child relationships, which are common indicators of malware execution. This broad overview helps pinpoint potential malicious executables requiring further scrutiny.
C
volatility -f memory.dmp procdump
Why wrong: The `volatility -f memory.dmp procdump` command is used to extract the executable image or memory regions of a *specific* process from the dump. While invaluable for subsequent in-depth analysis, such as reverse engineering or string extraction from a known malicious process, it requires the investigator to first identify the suspicious process's PID. Therefore, it is not an initial detection tool for broadly identifying an infection but rather a targeted analysis step performed after initial indicators have been found.
D
volatility -f memory.dmp svcscan
Why wrong: The `volatility -f memory.dmp svcscan` command enumerates all registered Windows services and their current states within the memory dump. While some malware achieves persistence by installing itself as a service, many infections operate as userland processes or inject into existing ones without creating new services. Consequently, `svcscan` is less direct for initial detection of active malware behavior compared to analyzing running processes or network connections, which are more immediate indicators of compromise.
E
volatility -f memory.dmp malfind
Why wrong: The `volatility -f memory.dmp malfind` command is designed to detect hidden or injected code within process memory, often indicative of advanced malware techniques like process injection or rootkit functionality. While extremely powerful for confirming sophisticated infections, it focuses on memory regions rather than providing an initial overview of all running processes or active network connections. It is a more specialized detection mechanism, typically employed after initial indicators suggest a process might be compromised.

Full breakdown with real-world context →

Question 20mediummatching

Read the full Cryptography and Malware Analysis explanation →

Match each vulnerability assessment tool to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Automated vulnerability scanning

Open-source vulnerability scanner

Cloud-based vulnerability management

Network vulnerability scanner

Web server vulnerability scanner

Trap 1: Nmap: Vulnerability scanning and risk assessment

This statement is incorrect because Nmap's primary function is network discovery, port scanning, and service enumeration, not comprehensive vulnerability scanning or risk assessment. While Nmap can identify open ports and service versions that might indicate potential vulnerabilities, it does not actively test for known exploits, misconfigurations, or provide detailed risk ratings like dedicated vulnerability scanners such as Nessus or OpenVAS. Its focus is on mapping the network landscape.

Trap 2: Nessus: Network port scanning and service detection

This statement incorrectly attributes the function of network port scanning and service detection to Nessus. While Nessus performs some initial host discovery and port enumeration as part of its scanning process, its core purpose is to identify and report on specific vulnerabilities, misconfigurations, and compliance issues. Dedicated tools like Nmap are specifically designed and optimized for efficient and granular network port scanning and service version identification.

Trap 3: OpenVAS: Packet capture and analysis

This statement is incorrect because OpenVAS (Open Vulnerability Assessment System) is a comprehensive open-source vulnerability scanner, similar in function to Nessus. Its primary role is to identify security weaknesses, misconfigurations, and unpatched software on target systems by performing active checks against a vast and regularly updated database of vulnerability tests. Packet capture and analysis, on the other hand, is the domain of tools like Wireshark, which passively monitor and dissect network traffic.

Study all Cryptography and Malware Analysis common traps →

A
Nmap: Network port scanning and service detection
Nmap (Network Mapper) is a powerful open-source utility for network discovery and security auditing. It uses raw IP packets to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, and what type of packet filters/firewalls are in use. Its primary function is to map out network topology and identify open ports and active services.
B
Nessus: Vulnerability scanning and risk assessment
Nessus, developed by Tenable, is a widely recognized proprietary vulnerability scanner. It actively probes target systems for known vulnerabilities, misconfigurations, default credentials, and patch deficiencies across various operating systems, applications, and network devices. The tool then provides detailed reports, often including risk ratings and remediation suggestions, to help organizations prioritize and address identified security weaknesses effectively.
C
Metasploit: Penetration testing exploitation framework
The Metasploit Framework is an open-source penetration testing platform that provides a comprehensive collection of exploits, payloads, and post-exploitation modules. It is designed to assist security professionals in identifying, exploiting, and validating vulnerabilities in systems and applications. This framework allows for the development, testing, and execution of exploit code against remote targets, simulating real-world attack scenarios to assess an organization's security posture.
D
Nmap: Vulnerability scanning and risk assessment
Why wrong: This statement is incorrect because Nmap's primary function is network discovery, port scanning, and service enumeration, not comprehensive vulnerability scanning or risk assessment. While Nmap can identify open ports and service versions that might indicate potential vulnerabilities, it does not actively test for known exploits, misconfigurations, or provide detailed risk ratings like dedicated vulnerability scanners such as Nessus or OpenVAS. Its focus is on mapping the network landscape.
E
Nessus: Network port scanning and service detection
Why wrong: This statement incorrectly attributes the function of network port scanning and service detection to Nessus. While Nessus performs some initial host discovery and port enumeration as part of its scanning process, its core purpose is to identify and report on specific vulnerabilities, misconfigurations, and compliance issues. Dedicated tools like Nmap are specifically designed and optimized for efficient and granular network port scanning and service version identification.
F
OpenVAS: Packet capture and analysis
Why wrong: This statement is incorrect because OpenVAS (Open Vulnerability Assessment System) is a comprehensive open-source vulnerability scanner, similar in function to Nessus. Its primary role is to identify security weaknesses, misconfigurations, and unpatched software on target systems by performing active checks against a vast and regularly updated database of vulnerability tests. Packet capture and analysis, on the other hand, is the domain of tools like Wireshark, which passively monitor and dissect network traffic.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Cryptography and Malware Analysis sessions

Start a Cryptography and Malware Analysis only practice session

Every question in these sessions is drawn from the Cryptography and Malware Analysis domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Cryptography and Malware Analysis questions →Mixed CEH session

Frequently asked questions

What does the CEH exam test about Cryptography and Malware Analysis?: Cryptography and Malware Analysis questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Cryptography and Malware Analysis questions in a focused session?: Yes — the session launcher on this page draws every question from the Cryptography and Malware Analysis domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CEH topics?: Use the topic links above to move to related areas, or go back to the CEH question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CEH exam covers. They are not copied from any real exam or dump site.

Cryptography and Malware Analysis only

10 questions 20 questions 30 questions 50 questions

Mixed CEH session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CEH questions Cryptography and Malware Analysis domain overview CEH exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Cryptography and Malware Analysis practice questions

What to know about Cryptography and Malware Analysis

Common Cryptography and Malware Analysis exam traps

Cryptography and Malware Analysis questions

Which THREE of the following are types of cryptanalytic attacks? (Choose three.)

Refer to the exhibit. A security analyst runs netstat on a compromised Windows machine. Based on the output, which process is most likely associated with the malicious activity?

Exhibit

Drag and drop the steps to configure a wireless network with WPA2-Enterprise authentication on a Cisco AP into the correct order.

A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

Exhibit

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

Match each vulnerability assessment tool to its function.

Track your progress over time

Start a Cryptography and Malware Analysis only practice session

Related CEH topic practice pages

Footprinting, Reconnaissance and Scanning practice questions

Enumeration and System Hacking practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions

Introduction to Ethical Hacking practice questions

Scanning Networks and Enumeration practice questions

Vulnerability Analysis and System Hacking practice questions

Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Footprinting and Reconnaissance practice questions

Network and Web Application Attacks practice questions

Wireless, IoT and Cloud Security practice questions