CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
Which THREE of the following are cryptanalysis attacks that target hash functions? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preimage attack
Birthday attack exploits hash collisions, preimage attack finds an input that hashes to a given output, and collision attack finds two inputs with same hash. Man-in-the-middle is not specific to hash functions, and dictionary attack is a password cracking technique, not pure cryptanalysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Man-in-the-middle attack
Why it's wrong here
A Man-in-the-middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. While an MITM attack can compromise the integrity or authenticity of data that might use hash functions for verification, it is fundamentally an interception and impersonation attack on a communication channel. It does not directly exploit the mathematical properties or internal workings of a hash function itself, distinguishing it from cryptanalytic attacks.
- ✓
Preimage attack
Why this is correct
A preimage attack is a cryptanalytic technique where an attacker, given a specific hash output (H), attempts to find an input message (M) such that H(M) = H. This directly violates the one-way property of a secure hash function, which dictates that it should be computationally infeasible to reverse the hashing process. Successfully performing a preimage attack compromises the integrity and authenticity guarantees provided by the hash, as an attacker could forge a message with a desired hash.
- ✓
Collision attack
Why this is correct
A collision attack aims to find two distinct input messages, M1 and M2, such that H(M1) = H(M2), where H is the hash function. Unlike a preimage attack, the attacker does not need to target a specific hash output; any pair of colliding inputs is sufficient. This attack undermines the collision resistance property of a hash function, which is crucial for digital signatures and other security applications, as it allows for the creation of two different documents with the same signature.
- ✓
Birthday attack
Why this is correct
The Birthday attack is a specific type of cryptanalytic attack that exploits the mathematics behind the birthday problem in probability theory to find collisions in hash functions more efficiently than brute-force methods. It significantly reduces the computational effort required to find two distinct inputs (M1, M2) that produce the same hash output (H(M1) = H(M2)). This attack demonstrates that a hash function's collision resistance is typically weaker than its preimage resistance, often requiring only about 2^(n/2) operations for an n-bit hash.
- ✗
Dictionary attack
Why it's wrong here
A dictionary attack is a type of brute-force attack primarily used to crack passwords or passphrases by systematically trying all words in a pre-compiled list, or "dictionary." While it often targets hashed passwords, the attack itself is against the password's weakness (its presence in a dictionary) rather than a cryptanalytic exploit of the hash function's mathematical properties or internal algorithm. It does not aim to break the hash function's one-way or collision resistance properties directly.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are valid cryptanalytic attacks?
medium- A.SQL injection
- ✓ B.Replay attack
- ✓ C.Downgrade attack
- D.Cross-site scripting (XSS)
- ✓ E.Birthday attack
Why B: Birthday attack exploits hash collisions; replay attack reuses captured data. Downgrade attack forces a system to use a weaker cryptographic protocol or cipher suite, which is a form of cryptanalytic attack. SQL injection and XSS are web application attacks, not cryptanalytic.
Variation 2. Which THREE of the following attacks target cryptographic weaknesses?
hard- ✓ A.Downgrade attack
- B.Replay attack
- C.Cross-site scripting
- ✓ D.Birthday attack
- E.SQL injection
Why A: A downgrade attack is correct because it forces a system to use a weaker, less secure cryptographic protocol or algorithm (e.g., forcing TLS 1.2 down to SSL 3.0 or using export-grade ciphers). This exploits the cryptographic weakness of the older protocol, making it easier for an attacker to decrypt or manipulate the communication. The attack directly targets the cryptographic strength of the negotiated security parameters.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.