Rainbow Tables and Password Cracking ECES Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst needs to crack a list of 500 unsalted SHA-256 password hashes from a legacy system. The passwords are known to be 8-character lowercase alphabetic. The analyst has a machine with 16 GB of RAM and 2 TB of disk. Which approach is most efficient in terms of time and resources?

   • AUse a rainbow table with a well-chosen chain length and reduction function to balance time and memory.
   • BUse a dictionary attack with a wordlist of common passwords.
   • CPerform a brute-force attack trying every possible password sequentially.
   • DGenerate a full lookup table of all possible hashes and store them on disk.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is using a rainbow table to crack a hash. The table was built with chains of length 1000. The analyst computes the reduction function on the target hash and then repeatedly applies hash and reduction functions. After 500 iterations, the analyst finds a value that matches a chain endpoint stored in the table. What is the next step to recover the original password?

   • AStart from the chain's starting point and apply hash and reduction functions until reaching the target hash, then take the password that produced it.
   • BReverse the hash function to obtain the password from the endpoint.
   • CApply the reduction function once more to the endpoint to get the password directly.
   • DUse the endpoint as the password and verify it by hashing it.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is considering using rainbow tables to audit password strength across its user database. The database stores passwords hashed with a per-user salt and a key-stretching algorithm. The security team wants to know if rainbow tables are a viable approach. What is the most accurate assessment?

   • ARainbow tables are viable because key stretching only affects brute force, not precomputation.
   • BRainbow tables are viable if the team uses a larger table to cover the salt values.
   • CRainbow tables are not viable because the per-user salt and key stretching make precomputation ineffective and slow.
   • DRainbow tables are viable if the team generates a separate table for each user's salt.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a practical limitation of rainbow tables when cracking long or complex passwords?

   • AThe table can only crack passwords with uppercase letters
   • BThe table becomes too large to store or generate
   • CThe reduction function cannot handle long passwords
   • DThe hash function becomes slower for longer passwords
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which password cracking technique uses a precomputed set of hashes to reverse a target hash?

   • ADictionary attack
   • BRainbow table attack
   • CRule-based attack
   • DBrute force
   Reveal Solution Discussion Select an answer first