Password Cracking Techniques and Countermeasures ECSS Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A company is implementing a new password storage system. They want to protect against both offline cracking and online guessing attacks. Which combination of measures is most effective?

   • AUse plaintext storage and require complex passwords
   • BUse a fast hashing algorithm and rely on network encryption
   • CUse a slow hashing algorithm and enforce account lockout after multiple failed attempts
   • DUse unsalted hashes and disable account lockout to avoid user frustration
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security architect is reviewing a legacy application that stores passwords as unsalted SHA-256 hashes. The application is being migrated to a new platform, and the architect must choose a new password storage mechanism. The migration must be completed within a tight deadline, and the team has limited experience with new cryptographic libraries. The architect wants to maximize security while minimizing implementation risk. Which approach should the architect take?

   • AUse plaintext storage with database encryption at rest
   • BUse bcrypt with a unique salt per user, implemented using a well-documented library
   • CUse salted SHA-256 with a unique salt per user, implemented in-house
   • DUse a custom hashing algorithm developed by the team
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer is designing a new authentication system and wants to store passwords securely. The developer is considering different storage mechanisms and wants to prevent both rainbow table attacks and slow down brute-force attempts. Which storage mechanism should the developer choose?

   • ASalted bcrypt hashes with a unique salt per user
   • BPlaintext storage in a database
   • CSalted SHA-256 hashes with a unique salt per user
   • DUnsalted MD5 hashes
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester is assessing a web application that uses a custom authentication mechanism. The tester has captured a set of hashes that appear to be salted SHA-512. The tester has a wordlist of 1 million common passwords and a CPU-only workstation (no GPU). The tester needs to crack as many hashes as possible within 24 hours. Which tool and strategy is most appropriate?

   • AUse rainbow tables for the salted hashes
   • BUse Hydra to perform an online brute-force attack
   • CUse John the Ripper with a dictionary attack and a rule-based mutation pass
   • DUse Hashcat with a brute-force mask attack
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which tool is commonly used for password cracking and supports a wide variety of hash algorithms, including CPU-based cracking?

   • AMetasploit
   • BWireshark
   • CJohn the Ripper
   • DNmap
   Reveal Solution Discussion Select an answer first