Password Cracking and Attacks CEH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's authentication database was breached, and the attacker obtained the password hashes. The hashes are unsalted and use a fast hashing algorithm. The company wants to prevent attackers from using precomputed tables to crack the hashes in the future. Which mitigation is most effective?

   • AIncrease the minimum password length to 20 characters
   • BAdd a unique salt to each password hash
   • CStore the hashes in a separate database
   • DUse a slower hashing algorithm like bcrypt
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network administrator discovers that several network switches are still using the default administrative password. The administrator wants to remediate this vulnerability quickly across all switches. Which action is the most effective first step?

   • ADocument the default passwords in the configuration management system
   • BDisable the administrative interface on all switches
   • CChange the default password on each switch to a unique strong password
   • DImplement a network access control (NAC) solution to restrict management access
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network administrator discovers that several employees use the same default password 'Welcome123' for their domain accounts. Which combination of actions best mitigates the risk posed by this weak-password usage?

   • ADisable password expiration to avoid user frustration
   • BForce a password change at next logon and enable a banned-password list
   • CEnable verbose login error messages to help users remember passwords
   • DIncrease the account lockout threshold to 10 attempts
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which scenario best describes an online password attack?

   • AAn attacker intercepts a password hash from network traffic
   • BAn attacker uses a dictionary attack on a local password file
   • CAn attacker uses a rainbow table to crack a stolen hash
   • DAn attacker repeatedly submits guessed passwords to a web login form
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A system administrator discovers that the company's legacy application stores passwords as unsalted SHA-1 hashes. The admin wants to migrate to a more secure scheme without forcing all users to reset passwords immediately. Which approach is the most practical?

   • ARehash all existing hashes with a new salt and a slow KDF
   • BForce a password reset for all users and store new hashes with bcrypt
   • CAdd a static salt to the existing SHA-1 hashes
   • DKeep SHA-1 but add a pepper stored in the application config
   Reveal Solution Discussion Select an answer first