SSCP Cryptography Practice Question
An organization is moving away from legacy encryption and wants to avoid stream ciphers due to known vulnerabilities. Which of the following algorithms should be avoided because it is a stream cipher with known weaknesses like the BEAST attack?
⚠ Common exam trap
A common mix-up: candidates assume all stream ciphers are equally vulnerable, but ChaCha20 is a modern, secure stream cipher, while RC4 is the specific one with known weaknesses like BEAST.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RC4
RC4 is a stream cipher with known weaknesses, such as biases in its output stream that can lead to plaintext recovery attacks. Although the BEAST attack actually exploits CBC mode in TLS 1.0, RC4 was often used as a workaround; however, RC4 itself has inherent vulnerabilities, making it unsuitable for secure encryption. Since the organization wants to avoid stream ciphers due to such vulnerabilities, RC4 should be avoided.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RC4
Why this is correct
RC4 is the deprecated stream cipher.
- ✗
3DES
Why it's wrong here
3DES is a block cipher.
- ✗
AES-GCM
Why it's wrong here
AES-GCM is a block cipher mode, not a stream cipher.
- ✗
ChaCha20
Why it's wrong here
ChaCha20 is a modern stream cipher considered secure.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a secure alternative to RC4 for stream ciphers?
easy- A.MD5
- B.AES in ECB mode
- ✓ C.ChaCha20
- D.3DES
Why C: ChaCha20 is a modern, high-speed stream cipher designed by Daniel J. Bernstein as a secure alternative to RC4, which has known vulnerabilities such as biases in its keystream and susceptibility to attacks like the Fluhrer-Mantin-Shamir attack. ChaCha20 is standardized in RFC 8439 and is widely used in TLS 1.3 and SSH, offering strong security and performance without the weaknesses of RC4.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.