Exactly. To me a senior consultant should be able to spot the obvious error and then focus on trying to understand what the customer need and move the solution

Exactly. To me a senior consultant should be able to spot the obvious error and then focus on trying to understand what the customer need and move the solution to something that meets the intent. If it is confidentiality the customer need, provide good solutions to that. But check if confidentiality is really the thing needed. Quite probably, authentication and integrity protection is what is really needed. So AES in CTR mode might not be what the customer should want instead of MD5, but possibly AES-GCM, AES-CMAC or even a Ed25519 signature mechanism using public key.