Rainbow Tables and Password Cracking ECES Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A web application currently stores passwords using unsalted SHA-1. The security team wants to protect against rainbow table attacks without forcing users to reset passwords. They have access to the plaintext passwords during the next login. Which remediation is most effective?

   • AOn each successful login, rehash the password with a unique random salt and a key-stretching algorithm like PBKDF2, then store the new hash and salt.
   • BStore the SHA-1 hash twice to make it harder to crack.
   • CUse a pepper stored in the application configuration and hash the password with SHA-256 plus the pepper.
   • DAdd a static salt to all passwords and rehash with SHA-256.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   After a rainbow table lookup finds a matching chain endpoint, how is the original password recovered?

   • ABy reversing the reduction function mathematically
   • BBy regenerating the chain from its start point until the target hash is encountered
   • CBy looking up the endpoint in a separate dictionary
   • DBy decrypting the endpoint with a private key
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How does salting defend against rainbow table attacks?

   • AIt makes the hash function slower
   • BIt encrypts the password before hashing
   • CIt adds a unique random value to each password before hashing
   • DIt stores the password in a separate database
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Compared to a simple lookup table that stores every hash-password pair, a rainbow table primarily trades what for what?

   • AStorage for computation time
   • BMemory for disk space
   • CNetwork bandwidth for CPU cycles
   • DComputation time for storage
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is comparing password cracking methods for a penetration test. The target system uses unsalted SHA-1 hashes, and the team has a list of 10,000 common passwords. The team also has access to a large precomputed rainbow table for SHA-1. Which statement accurately compares the two approaches?

   • ABoth methods require the same amount of storage to be effective.
   • BThe rainbow table requires more computational effort per hash than the dictionary attack.
   • CThe rainbow table will always find the password faster than the dictionary attack.
   • DThe dictionary attack will always succeed if the password is in the wordlist, while the rainbow table may fail due to coverage gaps.
   Reveal Solution Discussion Select an answer first