FirstTry

Exam objective

CEH

Cryptography

This objective sits in Cryptography, which carries 5% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Cryptography

A TLS scan of a payment gateway returns the supported cipher list below.

| ssl-enum-ciphers:|   TLSv1.2:|     ciphers:|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A|     least strength: C

What must the operator change?

Raise the RSA key size to 4096 bitsKey size is not the weakness here; a 2048 bit RSA key remains acceptable for TLS today.
Enable TLS 1.0 fallback so older clients can connectTLS 1.0 fallback would answer a compatibility complaint, and it adds a deprecated protocol version to an endpoint already offering weak ciphers.
Remove the RC4 suite from the server configurationCorrect · your answerCorrect. The weak stream cipher is the finding, and withdrawing its suite is the change that clears it.
Disable the elliptic curve suite and keep RC4Disabling the elliptic curve suite removes the strong option and leaves only the weak one, which is the opposite of the fix.

Correct.

Checked against rfc-editor.org, September 2026

Concept

TLS negotiates the strongest cipher both sides are willing to offer, so a weak suite left enabled remains reachable by any client that asks for it.

Why C

The scan shows a stream cipher graded C sitting beside a modern AEAD option. A client that offers only the weak one will still be served, so the suite has to go.

Source

Because of the RC4 deficiencies noted in Section 1, the following apply: o TLS clients MUST NOT include RC4 cipher suites in the ClientHello message. o TLS servers MUST NOT select an RC4 cipher suite when a TLS client sends such a cipher suite in the ClientHello message.

IETF RFC 7465, Prohibiting RC4 Cipher Suites, checked September 2026
#tls#rc4#cipher-suites

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Cryptography

An organization keeps SSL 3.0 enabled so an old client can connect. A tester recovers session cookies from the encrypted stream one byte at a time. Which weakness is exploited?

Sample question 2 of 3

Cryptography

An architect needs recorded TLS sessions to stay unreadable if the server private key is stolen next year. Which TLS 1.3 change provides that?

Sample question 3 of 3

Cryptography

A developer appends a plain SHA-256 digest to each API message for integrity. An attacker who can modify traffic recomputes the digest and stays undetected. What does HMAC add?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.