5.4 Describe Security Password Policy Elements, Such as Management, Complexity, and Password Alternatives (multifactor Authentication, Certificates, and Biometrics) 200-301 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A system administrator is configuring password storage for a new application. The application must store user passwords in a database. Which method is the most secure and industry-recommended approach?

   • AHash each password with a unique random salt using a slow, adaptive hashing algorithm such as bcrypt or Argon2.
   • BEncrypt the passwords with a symmetric key and store the key in the application configuration file.
   • CStore passwords in plain text to simplify account recovery and avoid user lockouts.
   • DUse a fast hashing algorithm like MD5 without a salt to minimize database storage overhead.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company requires employees to use a VPN to access internal resources. The VPN currently uses only a username and password. After a phishing attack compromised several accounts, the security team wants to add an additional authentication factor that is resistant to phishing. Which solution best meets this requirement?

   • ASend a one-time passcode via SMS to the user's registered phone.
   • BRequire users to answer personal security questions after entering their password.
   • CAsk users to provide their employee ID number in addition to the password.
   • DDeploy a hardware token that generates a time-based one-time password (TOTP).
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A hospital is implementing biometric authentication for staff access to patient records. The system uses fingerprint recognition. The security team is concerned about the risk of an attacker using a fake fingerprint (spoofing). Which additional measure would most effectively mitigate spoofing while maintaining usability?

   • AStore the fingerprint image in the database for forensic analysis.
   • BRequire a longer password in addition to the fingerprint.
   • CIncrease the false acceptance threshold so that only perfect matches are accepted.
   • DUse a biometric system with liveness detection that verifies blood flow or skin texture.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How does certificate-based authentication verify a user's identity?

   • ABy sending the certificate to a central server for password validation
   • BBy comparing the user's password to a hash stored in the certificate
   • CBy verifying the user's biometric data stored in the certificate
   • DBy checking that the user possesses the private key corresponding to the certificate's public key
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A financial institution is deploying certificate-based authentication for its remote workforce. The security team must ensure that certificates can be revoked immediately if an employee leaves or a laptop is lost. The current PKI issues certificates with a 5-year validity. Which additional control is essential to meet the revocation requirement?

   • APublish a Certificate Revocation List (CRL) and configure applications to check it during authentication.
   • BShorten the certificate validity period to 1 year so that revoked certificates expire sooner.
   • CRequire users to report lost laptops within 24 hours and rely on password changes.
   • DStore all private keys on a central server so that they can be disabled remotely.
   Reveal Solution Discussion Select an answer first