hardMultiple SelectObjective-mapped
Insecure and Deprecated Cryptographic Algorithms for SSCP
A security auditor is reviewing the cryptographic algorithms used in an organization. Which THREE of the following are considered insecure or deprecated and should be avoided? (Select THREE.)
Quick Answer
The answer is MD5, DES, and 3DES, as these three are the insecure deprecated cryptographic algorithms that should be avoided. MD5 is broken due to practical collision attacks achievable in seconds on commodity hardware, while DES uses a dangerously short 56-bit key that cannot withstand modern brute-force attempts, and 3DES, though an improvement, is now deprecated by NIST due to slow performance and susceptibility to meet-in-the-middle attacks. On the Systems Security Certified Practitioner SSCP exam, this question tests your ability to identify outdated ciphers and hash functions that violate current security baselines—a common trap is confusing 3DES as still acceptable because it was once a standard, but remember NIST disallowed it for new applications after 2023. A useful memory tip: think “D3M” for Deprecated, DES, 3DES, and MD5—all three are dead ends for secure cryptography.
⚠ Common exam trap
ISC2 often tests the misconception that 3DES is still acceptable because it is 'triple' strength, but the trap is that both DES and 3DES are deprecated due to small block sizes and key lengths, while MD5 is often mistakenly considered safe for checksums despite its proven collision vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DES
DES (Data Encryption Standard) uses a 56-bit key, which is too short to withstand modern brute-force attacks; it was officially withdrawn as a standard by NIST in 2005. 3DES, while an improvement, is now deprecated due to its relatively slow performance and susceptibility to meet-in-the-middle attacks, with NIST disallowing it for new applications after 2023. MD5 is a broken hash algorithm; collision attacks (e.g., using a chosen-prefix collision) can be performed in seconds on commodity hardware, making it unsuitable for any security-sensitive use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RSA-2048
Why it's wrong here
RSA with 2048-bit keys is still considered secure.
- ✓
DES
Why this is correct
DES uses a 56-bit key, making it vulnerable to brute-force attacks.
- ✓
3DES
Why this is correct
3DES is deprecated due to performance issues and theoretical attacks.
- ✗
AES-256
Why it's wrong here
AES-256 is a current standard and considered secure.
- ✓
MD5
Why this is correct
MD5 is vulnerable to collision attacks and is broken.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following cryptographic algorithms are considered secure for modern use?
medium- A.MD5 (Message Digest 5)
- ✓ B.ChaCha20
- ✓ C.AES-256 (Advanced Encryption Standard with 256-bit key)
- D.RC4 (Rivest Cipher 4)
- E.DES (Data Encryption Standard)
Why B: ChaCha20 (option B) and AES-256 (option C) are considered secure for modern use. DES, RC4, and MD5 are broken or deprecated.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.