16 free EC-Council 212-81v3 ECES practice questions from the CertStash pack of 64, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 16 free here, all 64 in the pack, and each step includes the one before it.
Get all 64 questions (US$39) · Download the first 10 as a PDF
Question 1
Sheryl is explaining PKI to a group of non-technical executives. She first wants to identify the specific components of PKI. Which one of the following is a component of the PKI?
Show answer and explanation
Correct answer: A. CA
A Certificate Authority (CA) is a core component of Public Key Infrastructure responsible for issuing, managing, and revoking digital certificates. The CA validates the identity of entities and signs certificates with its private key, establishing the trust foundation of the PKI system.
Why the other options are wrong
- B. TGT (Ticket Granting Ticket) is a component of Kerberos authentication, not PKI.
- C. OCSP (Online Certificate Status Protocol) is a protocol used within PKI to check certificate revocation status, not a primary structural component of PKI itself.
- D. TGS (Ticket Granting Service) is part of the Kerberos protocol, not a PKI component.
Question 2
You are studying classic ciphers. You have been examining the difference between single substitution and multi-substitution. Which one of the following is an example of a multi-alphabet cipher?
Show answer and explanation
Correct answer: B. Vigenère
The Vigenère cipher is a multi-alphabet substitution cipher that uses a repeating key to encrypt plaintext by shifting each letter by a different amount depending on the corresponding key letter position. This polyalphabetic approach makes it significantly more resistant to frequency analysis than single-alphabet substitution ciphers.
Why the other options are wrong
- A. Atbash is a single-alphabet substitution cipher that maps each letter to its reverse in the alphabet.
- C. Caesar cipher is a single-alphabet substitution cipher that shifts every letter by a fixed number of positions.
- D. Rot13 is a single-alphabet substitution cipher that shifts every letter by exactly 13 positions.
Question 3
3DES can best be classified as which one of the following?
Show answer and explanation
Correct answer: C. Symmetric algorithm
3DES (Triple DES) is a symmetric encryption algorithm that applies the DES cipher three times to each data block. It uses the same key (or keys derived from the same key material) for both encryption and decryption, which is the defining characteristic of symmetric algorithms. 3DES was widely used to strengthen DES before AES became the standard.
Why the other options are wrong
- A. Hashing algorithms produce fixed-size digests and are not used for encryption; 3DES is an encryption cipher.
- B. Digital signatures are cryptographic mechanisms for authentication and non-repudiation; 3DES is an encryption algorithm.
- D. Asymmetric algorithms use different keys for encryption and decryption (public and private keys); 3DES uses the same key for both operations.
Question 4
You have been tasked with selecting a digital certificate standard for your company to use. Which one of the following is an international standard for the format and information contained in a digital certificate?
Show answer and explanation
Correct answer: D. X.509
X.509 is the international standard (ITU-T) that defines the format and information contained in digital certificates. It specifies the structure of public key certificates including fields for the subject, issuer, validity period, public key, and extensions. X.509 certificates are the foundation of PKI systems worldwide.
Why the other options are wrong
- A. CA (Certificate Authority) is an entity that issues certificates, not a certificate format standard.
- B. CRL (Certificate Revocation List) is a list of revoked certificates, not a format standard for certificate structure.
- C. RFC 2298 relates to Message Disposition Notifications, not digital certificate formats.
Question 5
What is the basis for the difficulty in breaking RSA?
Show answer and explanation
Correct answer: A. Factoring numbers
RSA's security is based on the difficulty of factoring large composite numbers into their prime factors. The RSA algorithm uses a public key derived from the product of two large prime numbers, and breaking RSA requires factoring this product back into those primes, a computationally infeasible task with current technology when sufficiently large primes are used.
Why the other options are wrong
- B. Hashing is not the basis of RSA security; RSA is based on number theory and factorization difficulty.
- C. Elliptic curve equations are the basis for elliptic curve cryptography (ECC), not RSA.
- D. The birthday paradox is relevant to hash collision attacks and birthday attacks, not RSA security.
Question 6
How does Kerberos generate the first secret key in the authentication process?
Show answer and explanation
Correct answer: A. By creating a hash of the user password
Kerberos generates the initial secret key by creating a hash of the user's password. This hashed password serves as the encryption key used in the authentication exchange between the client and the Key Distribution Center (KDC). The user enters their password, which is hashed, and this hash is used to decrypt the initial authentication ticket.
Why the other options are wrong
- B. Kerberos does not generate random AES keys for the initial secret key; it derives the key from the password hash.
- C. Kerberos uses symmetric cryptography based on passwords, not public keys for the initial secret generation.
- D. While salts are used in password hashing, Kerberos uses password hashing directly, not a complex formula involving user ID and network ID.
Question 7
The mode makes a block cipher into a synchronous stream cipher. It generates keystream blocks, which are then XORed with the plaintext blocks to get the ciphertext.
Show answer and explanation
Correct answer: B. Output feedback (OFB)
Output Feedback (OFB) mode converts a block cipher into a synchronous stream cipher by generating keystream blocks independently and XORing them with plaintext blocks. In OFB, the output of the cipher is fed back as input to generate the next keystream block, and errors in one ciphertext block do not propagate to subsequent blocks.
Why the other options are wrong
- A. Electronic Codebook (ECB) is a block cipher mode that encrypts each plaintext block independently; it does not create a stream cipher.
- C. Cipher Feedback (CFB) is also a stream cipher mode, but it is asynchronous rather than synchronous, with error propagation between blocks.
- D. Cipher Block Chaining (CBC) is a block cipher mode where each ciphertext block depends on the previous one; it is not a stream cipher mode.
Question 8
Ferris has been assigned the task of selecting security for his company’s wireless network. It is important that he pick the strongest form of wireless security. Which one of the following is the strongest wireless security?
Show answer and explanation
Correct answer: C. WPA2
WPA2 (Wi-Fi Protected Access 2) is the strongest wireless security standard among the options. It uses AES encryption with CCMP (Counter with CBC-MAC Protocol) and supports both personal and enterprise authentication modes. WPA2 addressed the vulnerabilities of both WEP and the original WPA, and remains the standard recommendation for wireless security.
Why the other options are wrong
- A. WEP (Wired Equivalent Privacy) is severely broken and easily cracked; it is obsolete and provides minimal security.
- B. TKIP (Temporal Key Integrity Protocol) was an improvement over WEP but was designed as a temporary solution and has known vulnerabilities.
- D. WPA (Wi-Fi Protected Access) was an interim standard that improved upon WEP but is weaker than WPA2 due to potential TKIP vulnerabilities.
Question 9
Tom is explaining historical cryptography to a class of security students. Which of the following ciphers is a subset of the Vigenère cipher?
Show answer and explanation
Correct answer: B. Caesar
The Caesar cipher is a subset of the Vigenère cipher. The Caesar cipher uses a single fixed shift value for all letters, while the Vigenère cipher uses a keyword to determine multiple shift values that repeat across the message. When a Vigenère cipher uses a key of length 1 (a single repeated character), it becomes identical to a Caesar cipher.
Why the other options are wrong
- A. The Scytale is a transposition cipher using a physical rod; it is not related to the Vigenère cipher's substitution method.
- C. Blowfish is a modern symmetric block cipher; it has no historical relationship to the Vigenère cipher.
- D. Atbash is an ancient substitution cipher that reverses the alphabet; it is not a subset of or related to the Vigenère cipher.
Question 10
What is a variation of DES that uses a technique called Key Whitening?
Show answer and explanation
Correct answer: C. DESX
DESX (DES with eXtended key material) is a variation of DES that uses a technique called key whitening. Key whitening XORs additional key material with the plaintext before encryption and with the ciphertext after encryption, effectively extending the key length and providing additional security against brute force attacks without changing the core DES algorithm.
Why the other options are wrong
- A. AES is a completely different block cipher standard that succeeded DES; it does not use key whitening as a variation of DES.
- B. 3DES applies DES three times with different keys or key material; it does not specifically use key whitening as its primary technique.
- D. Blowfish is an independent block cipher algorithm by Bruce Schneier; it is not a DES variant and does not use key whitening.
What people say about the full 212-81v3 ECES pack 4.5 from 2
Clear and focused exam practice questions made preparation smoother. The study material was detailed but not overwhelming.
Question 11
Which one of the following is an example of a symmetric key algorithm?
Show answer and explanation
Correct answer: A. Rijndael
Rijndael is the symmetric key block cipher that was selected as the AES (Advanced Encryption Standard). Both the sender and receiver use the same key for encryption and decryption. ECC (Elliptic Curve Cryptography) and RSA are asymmetric algorithms using public and private keys. Diffie-Hellman is a key exchange protocol, not an encryption algorithm.
Why the other options are wrong
- B. ECC is an asymmetric algorithm that uses a public key and private key pair.
- C. Diffie-Hellman is a key exchange protocol used to establish shared keys, not a symmetric encryption algorithm.
- D. RSA is an asymmetric algorithm that uses public and private keys.
Question 12
While many companies are working on quantum computing, what is the current biggest challenge?
Show answer and explanation
Correct answer: B. Decoherence
Decoherence is the primary technical challenge limiting practical quantum computing development. Quantum bits (qubits) are extremely fragile and lose their quantum properties when exposed to environmental interference, causing errors that corrupt calculations. While processing speed, funding, and power consumption are relevant concerns, decoherence represents the fundamental physical obstacle that prevents quantum computers from scaling to useful sizes and maintaining computational accuracy.
Why the other options are wrong
- A. Processing speed is not the main limitation; quantum computers can theoretically solve certain problems exponentially faster than classical computers when decoherence is managed.
- C. While funding is important for research, it is not the technical challenge preventing quantum computing advancement.
- D. Power consumption is manageable with current technology and is not the primary barrier to quantum computer development.
Question 13
John is trying to explain the basics of cryptography to a group of novice security students. Which one of the following most accurately defines encryption?
Show answer and explanation
Correct answer: D. Changing a message so it can only be easily read by the intended recipient
Encryption is fundamentally about changing a message so that only intended recipients can easily read it. While options A and B describe technical aspects involving mathematics, and option C is partially correct, option D most accurately captures the purpose and definition of encryption in practical terms, enabling secure communication by making a message readable only to authorized parties.
Why the other options are wrong
- A. This describes the mechanism but not the purpose or definition of encryption itself.
- B. While technically accurate, this focuses on process rather than the defining characteristic of achieving confidentiality.
- C. This is incomplete because encryption involves more than just applying keys, it transforms the message for secure communication purposes.
Question 14
What is the 160-bit hash algorithm developed by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel for which there are 128, 256 and 320-bit versions is called?
Show answer and explanation
Correct answer: D. RIPEMD
RIPEMD is a 160-bit cryptographic hash function developed by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel. It was designed as an alternative to MD4 and MD5, and has variants producing 128, 256, and 320-bit hash outputs, making it suitable for applications requiring stronger security than MD5 while offering flexibility in output size.
Why the other options are wrong
- A. SHA1 produces a 160-bit hash but was developed by the NSA, not by Dobbertin, Bosselaers, and Preneel.
- B. MD5 produces a 128-bit hash and was developed by Ronald Rivest, not the three cryptographers mentioned.
- C. FORK is not a recognized standard hash algorithm developed by these three cryptographers.
Question 15
Juanita has been assigned the task of selecting email encryption for the staff of the insurance company she works for. The various employees often use diverse email clients. Which of the following methods is available as an add-in for most email clients?
Show answer and explanation
Correct answer: D. PGP
PGP (Pretty Good Privacy) is widely available as an add-in or plugin for most major email clients, including Outlook, Thunderbird, and others. PGP provides end-to-end encryption and digital signatures specifically designed for email communication and has broad client support. Caesar cipher and DES are historical or block cipher methods not designed for email integration, and RSA is a mathematical algorithm rather than an email-specific encryption tool with client add-in availability.
Why the other options are wrong
- A. Caesar cipher is a historical substitution cipher unsuitable for modern email encryption and not available as client add-ins.
- B. DES is a symmetric block cipher not specifically designed for email and lacks standard email client integration.
- C. RSA is an encryption algorithm, not an email encryption solution with add-in support for multiple clients.
Question 16
Modern symmetric ciphers all make use of one or more s-boxes. Both Feistel and non-Feistel ciphers use these s-boxes. What is an s-box?
Show answer and explanation
Correct answer: C. A substitution box where input bits are replaced.
An s-box, or substitution box, is a component of modern symmetric ciphers that performs substitution operations where input bits are replaced with output bits according to a predefined lookup table. S-boxes are fundamental to both Feistel and non-Feistel cipher designs, providing nonlinearity to the encryption process.
Why the other options are wrong
- A. An s-box is a specific, well-defined cryptographic component, not a generic black box.
- B. Shifting operations are performed by other components; s-boxes specifically perform substitution, not shifting.
- D. While s-boxes are used within round functions, they are a specific component of the round function, not another name for it.
That was 16 of 64.
The full EC-Council 212-81v3 ECES pack has all 64 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 31 free as one PDF by email. Get the Half Pack →