CND Network Attacks And Defense Strategies Practice Question
A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Explicitly enforce a whitelist of approved cryptographic signing algorithms (e.g., RS256) and explicitly reject the 'none' algorithm in the JWT validation function.
Allowing the 'none' algorithm or omitting explicit algorithm verification in JWT libraries leads to signature bypass. The application code must explicitly enforce trusted cryptographic algorithms (e.g., HS256 or RS256) and reject tokens specifying 'none'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade the JWT token expiration time (exp claim) to expire within five minutes of creation.
Why it's wrong here
Short expiration times limit token lifespan, but do not prevent algorithm tampering.
- ✓
Explicitly enforce a whitelist of approved cryptographic signing algorithms (e.g., RS256) and explicitly reject the 'none' algorithm in the JWT validation function.
Why this is correct
Enforcing a whitelist of algorithms and rejecting 'none' prevents JWT signature bypasses.
- ✗
Implement JSON Web Encryption (JWE) to payload data without verifying headers.
Why it's wrong here
JWE encrypts payloads, but validation libraries still require explicit algorithm verification.
- ✗
Store JWT tokens in HTTP-only, Secure cookies instead of local browser storage.
Why it's wrong here
Storage mechanism changes protect against XSS token theft, but not algorithm manipulation.
About these practice questions
Courseiva writes every CND question from scratch — 323 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.