A Caesar cipher with K=3 on the English alphabet replaces A with D. What does it make of the plaintext WAX?RFC 4949, definition of "Caesar cipher"
Atbash maps the alphabet onto its reverse, so A becomes Z and B becomes Y. What does it make of DOG?Wikipedia, "Atbash", opening
In a Vigenère cipher, what decides how far each plaintext letter is shifted?Wikipedia, "Vigenère cipher", opening
What does a homophonic substitution cipher do to make frequency analysis harder?Wikipedia, "Substitution cipher", Homophonic
Which unit of plaintext does the Playfair cipher encrypt at a time?Wikipedia, "Playfair cipher", opening
Show all 63 questions (58 more)
Symmetric cryptography and hashes 28
A DES key is 64 binary digits long. How many of them does the algorithm use directly?FIPS 46-3 (withdrawn), announcement, Explanation
A hash function takes input of any length. What is true of its output?RFC 4949, definition of "hash function"
A new application is being designed in 2026. What does NIST SP 800-131A say about encrypting its data with three-key TDEA?NIST SP 800-131A Rev. 2, section 2
AES-128 has 10 rounds. How many times does the cipher apply AddRoundKey?FIPS 197, section 5.1.4
AES-256 uses a 256-bit key. How large is each block of data it transforms?FIPS 197, Abstract
An encrypted bitmap still shows the outline of the picture, because equal plaintext blocks became equal ciphertext blocks. Which mode was used?NIST SP 800-38A, section 6.1
How does a stream cipher differ from a block cipher?RFC 4949, definitions of "block cipher" and "stream cipher"
How large is the block that SHA-256 processes at a time?FIPS 180-4, section 1, Figure 1
How long is a SHA-1 message digest?FIPS 180-4, section 1, Figure 1
How long is the "fingerprint" that MD5 produces?RFC 1321, section 1
How many rounds does AES-192 run?FIPS 197, section 5, Table 3
In CBC mode, which operation can run on many blocks in parallel?NIST SP 800-38A, section 6.2
Kerckhoffs's principle says a cryptosystem should stay secure when what is public knowledge?Wikipedia, "Kerckhoffs's principle", opening
On which construction are the SHA-3 functions built?FIPS 202, Abstract and section 4
One plaintext bit is flipped and about half of the ciphertext bits change. Which property of a cipher is this?Wikipedia, "Confusion and diffusion", Definition
RC4 is a stream cipher. What does RFC 7465 require of TLS clients?RFC 7465, section 2
What does HMAC combine with a hash function to authenticate a message?FIPS 198-1, sections 2 and 4
What does the CTR mode require of its counter blocks?NIST SP 800-38A, Appendix B
What does the scrypt key derivation function add as protection against password cracking with custom hardware?RFC 7914, Abstract
What is the bitwise exclusive-OR of 1100 and 1010?NIST SP 800-38A, section 4.2
What may be true of the round function in a Feistel cipher, and the cipher can still be decrypted?Wikipedia, "Feistel cipher", opening
Where does RFC 6151 say MD5 is no longer acceptable?RFC 6151, section 2
Which condition belongs to a one-time pad?RFC 4949, definition of "one-time pad"
Which key bundle does the TDEA standard forbid outright?NIST SP 800-67 Rev. 2, section 3.1
Which key lengths does Blowfish accept?RFC 4949, definition of "Blowfish"
Which property hides how the ciphertext relates to the key?Wikipedia, "Confusion and diffusion", Definition
Which requirement does NIST place on the initialization vector of the CBC mode?NIST SP 800-38A, section 6.2
Which transformation is left out of the final round of the AES cipher?FIPS 197, section 5.1
Number theory and asymmetric cryptography 9
A toy RSA key uses p = 3, q = 11 and public exponent e = 7. Which private exponent d satisfies e times d = 1 modulo 20?RFC 8017, section 3.2
Blum Blum Shub generates pseudorandom bits by repeating which step?Wikipedia, "Blum Blum Shub", opening
What does the Diffie-Hellman algorithm do?RFC 4949, definition of "Diffie-Hellman"
What is 5 cubed, modulo 13?Wikipedia, "Modular arithmetic", opening
What is Euler's totient of 35, the count of whole numbers from 1 to 35 that share no factor with it?Wikipedia, "Euler's totient function", opening
What is the status of DSA under FIPS 186-5?FIPS 186-5, Appendix E
Which of these numbers is a Mersenne prime?Wikipedia, "Mersenne prime", opening
Which pair of numbers is coprime?Wikipedia, "Coprime integers", opening
Which RSA modulus size does NIST rate as comparable in strength to a 128-bit symmetric key?NIST SP 800-57 Part 1 Rev. 5, section 5.6.1.1, Table 2
Applications of cryptography 15
A certificate file opens with the line -----BEGIN CERTIFICATE-----. What lies between that line and the END line?RFC 7468, sections 2 and 5.1
How does a certificate revocation list identify each revoked certificate?RFC 5280, section 3.3
How does steganography differ from cryptography?RFC 4949, definition of "steganography"
How long is the initialization vector that WEP joins to its RC4 key?NIST SP 800-97, section 3.2
How many steps are in the CHAP handshake?RFC 1994, section 2
In a PKI, what does a registration authority (RA) not do?RFC 4949, definition of "registration authority"
In storage encryption, what is a container?NIST SP 800-111, section 3.1.2
What does the Server-based Certificate Validation Protocol (SCVP) let a client hand to a server?RFC 5055, Abstract
What is a PKCS #12 file used for?RFC 7292, Abstract
What is true of every symmetric encryption algorithm that remains in TLS 1.3?RFC 8446, section 1.2
What may an NSA Type 1 product encrypt that a Type 2 product may not?RFC 4949, definitions of "type 1 product" and "type 2 product"
Which three certificate statuses can an OCSP response give?RFC 6960, section 2.2
Which TLS versions does RFC 8996 formally deprecate?RFC 8996, Abstract
Which transport and port carry the PPTP control connection?RFC 2637, section 1.4
Why is the Password Authentication Protocol (PAP) considered weak?RFC 1334, section 2
Cryptanalysis 6
A long English text was enciphered with a simple substitution. In frequency analysis, the most common ciphertext letter most likely stands for which letter?Wikipedia, "Frequency analysis", opening
A rainbow table is precomputed to reverse password hashes. Which defense makes one table useless against a whole password file?Wikipedia, "Rainbow table", Defense against rainbow tables
An analyst can feed plaintexts of her own choosing to an encryption device and read each result. Which attack is this?RFC 4949, definition of "chosen-plaintext attack"
An analyst holds several intercepted ciphertexts and the matching plaintext of each. Which attack can she mount?RFC 4949, definition of "known-plaintext attack"
In a Kasiski examination of a Vigenère ciphertext, what do the distances between repeated strings reveal?Wikipedia, "Kasiski examination", How it works
What does differential cryptanalysis study?Wikipedia, "Differential cryptanalysis", opening
How this list was compiled: Own questions, written to the five domains and weights of EC-Council's ECES Exam Blueprint v1 (https://cert.eccouncil.org/images/doc/ECES-Exam-Blueprint-v1.pdf, read 2026-10-12), with the topic names of the course outline on EC-Council's ECES page (https://www.eccouncil.org/train-certify/ec-council-certified-encryption-specialist-eces/). Facts were read on 2026-10-12 in public texts: NIST FIPS 197, 180-4, 186-5, 198-1, 202 and the withdrawn FIPS 46-3, NIST SP 800-38A, 800-57 Part 1 Rev. 5, 800-67 Rev. 2, 800-97, 800-111 and 800-131A Rev. 2, IETF RFCs 1321, 1334, 1994, 2637, 4949, 5055, 5280, 6151, 6960, 7292, 7465, 7468, 7914, 8017, 8446 and 8996, and Wikipedia articles for the classical ciphers, number theory and cryptanalysis. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from an EC-Council exam, course, sample question or assessment, or from another practice product.
How it works
An unofficial EC-Council Certified Encryption Specialist practice test: 63 questions of our own across the five domains of the ECES exam blueprint. It is not affiliated with EC-Council and uses none of the exam's own questions.
Read the full guide
What the ECES exam covers
EC-Council's ECES Exam Blueprint v1, read on October 12, 2026, weights five domains: introduction and history of cryptography 8%, symmetric cryptography and hashes 44%, number theory and asymmetric cryptography 14%, applications of cryptography 24%, and cryptanalysis 10%. The bank matches those shares.
What is left out
Not asked: four ciphers the course outline names (FISH, PIKE, SHARK, McGuffin), the MD6 and FORK-256 hashes, the CrypTool and CryptoBench tools, and steganalysis methods.
AES always works on 128-bit blocks; the 128, 192 or 256 in its name is the key length (FIPS 197).
ECB turns equal plaintext blocks into equal ciphertext blocks under one key, so patterns survive it (NIST SP 800-38A).
A Caesar cipher with K=13 is ROT13; K=3 is the shift Julius Caesar used (RFC 4949).
Questions and answers
How many questions are on the ECES exam?
50 multiple-choice questions in 2 hours, by EC-Council's ECES page (exam code 212-81). Exam mode here asks 50 of our questions against a 120-minute clock.
What is the passing score for the ECES exam?
70%, by EC-Council's ECES page. Exam mode here uses the same mark on our own questions; a pass on this page is practice and no forecast of the real exam.
Does the ECES exam cover quantum cryptography?
The version 3 course outline has a module on it. The exam blueprint v1 lists five domains and none on quantum computing, so this bank asks no quantum questions.