Rainbow Tables and Password Cracking ECES Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security auditor is reviewing a legacy web application that stores user passwords as unsalted MD5 hashes. The auditor warns that an attacker with the hash database could recover many passwords using precomputed rainbow tables. The application team is planning to migrate to a modern framework and wants to prevent this specific attack going forward. Which change most directly addresses the rainbow table risk?

   • AUse a global static salt prepended to all passwords before hashing.
   • BSwitch from MD5 to SHA-256 without adding salt.
   • CAdd a unique random salt to each password before hashing with a strong algorithm such as bcrypt.
   • DIncrease the length of the password field in the database to 256 characters.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is using a rainbow table to crack a hash. The table has a chain length of 5,000. The analyst applies the reduction function to the target hash and gets a value that is not found in the table's endpoints. What should the analyst do next?

   • ACheck the table's start points to see if the hash is the first element of a chain.
   • BDiscard the hash and try a different rainbow table.
   • CReverse the reduction function to recover the original password directly.
   • DApply the hash and reduction functions repeatedly, checking the endpoint after each step, until a match is found or the chain length is exhausted.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a rainbow table, what is the role of a reduction function?

   • ATo encrypt plaintext into a hash
   • BTo sort the table for faster lookup
   • CTo convert a hash value into a plaintext candidate
   • DTo compress the table to reduce storage
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When using a rainbow table to crack a hash, what is the first step after receiving the target hash?

   • ADecrypt the hash using the table's secret key
   • BHash the hash again to see if it appears in the table
   • CSearch the table for the exact hash value as a stored endpoint
   • DApply the reduction function to the hash and check if the result matches a chain endpoint
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the main advantage of a rainbow table over brute-force password cracking?

   • AIt requires less storage than a full lookup table
   • BIt avoids repeated hashing of the same password by precomputing hashes
   • CIt uses a faster hash algorithm
   • DIt can crack any password instantly regardless of length
   Reveal Solution Discussion Select an answer first