Password Cracking Techniques and Countermeasures ECSS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an effective countermeasure to slow down brute-force attacks?

   • AImplementing account lockout after a few failed attempts
   • BStoring passwords in plaintext for easy verification
   • CUsing a short password length to reduce complexity
   • DDisabling password complexity requirements
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application currently stores passwords using unsalted SHA-1 hashes. The development team wants to migrate to a more secure storage mechanism. Which option provides the best protection against offline cracking attacks?

   • AUse unsalted MD5 for faster authentication
   • BUse salted SHA-256 with a unique salt per user
   • CUse plaintext storage with HTTPS only
   • DUse bcrypt with a cost factor of 12
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which countermeasure is most effective in preventing rainbow table attacks?

   • ARequiring users to change passwords every 90 days
   • BEnforcing a minimum password length of 8 characters
   • CUsing a strong hash algorithm like MD5
   • DUsing salted hashes
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A small company stores user passwords as unsalted SHA-256 hashes. After a breach, an attacker quickly recovered many passwords using precomputed lookup tables. The company wants to improve password storage without forcing an immediate password reset for all users. Which countermeasure should be implemented first?

   • AAdd a unique random salt to each password before hashing and rehash all passwords on next login
   • BStore passwords in plaintext to simplify account recovery
   • CUse a global static salt for all users to speed up verification
   • DSwitch to a faster hashing algorithm such as MD5 to reduce server load
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A company's authentication system uses a password-based key derivation function (PBKDF2) with a high iteration count. An attacker has obtained the password database. Which statement best describes the impact of the high iteration count?

   • AIt completely prevents offline cracking attacks
   • BIt makes dictionary attacks slower but does not prevent them
   • CIt makes rainbow table attacks more effective
   • DIt has no effect on cracking speed
   Reveal Solution Discussion Select an answer first