Password Cracking Techniques and Countermeasures ECSS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's security policy requires that user passwords be protected against offline cracking attempts. The current system uses unsalted SHA-1 hashes. The IT team is planning to migrate to a more secure storage mechanism. Which countermeasure should be prioritized during the migration?

   • AUse the same salt for all users to simplify the database schema
   • BUse a unique salt for each user and a slow hashing algorithm
   • CStore passwords in plaintext to simplify the migration process
   • DUse a faster hashing algorithm like MD5 to improve performance
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security engineer is reviewing a new application's password storage design. The proposed design uses a single global salt for all users and SHA-256 hashing. The engineer must recommend a change to improve security. The application is already in production, and changing the hashing algorithm would require a full password reset for all users. Which recommendation best balances security improvement with minimal user disruption?

   • ASwitch to per-user salts without changing the hashing algorithm
   • BKeep the current design and rely on database encryption at rest
   • CSwitch to bcrypt with per-user salts, requiring a full password reset
   • DKeep the current design but add a pepper to the hashing process
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A security auditor is testing a system that stores passwords as salted hashes. The auditor has access to the salt values and the hashes. Which attack is still viable?

   • ADictionary attack with the known salts
   • BPass-the-hash attack
   • CBrute-force attack on the salt value
   • DRainbow table attack using precomputed tables for the salt values
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization's password policy requires passwords to be at least 12 characters and include uppercase, lowercase, digits, and symbols. A security auditor wants to test the strength of these passwords against a dictionary-based attack. Which technique would be most effective against users who base their passwords on common phrases?

   • ARainbow table attack using precomputed hashes of all 12-character combinations
   • BHybrid attack combining a dictionary of common phrases with rule-based substitutions and appendages
   • CPure brute-force over the full 95-character printable ASCII set
   • DMask attack limited to exactly 12 characters with no rules
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A small company's web application currently stores user passwords as unsalted SHA-256 hashes. After a recent security review, the IT manager wants to implement a countermeasure that will significantly slow down offline cracking attempts without requiring users to change their passwords. The application is being migrated to a new framework that supports multiple hashing algorithms. Which change should the IT manager implement?

   • AUse a keyed hash (HMAC) with a server-side secret key
   • BAdd a pepper (a secret appended to the password before hashing)
   • CImplement a slow key derivation function such as bcrypt or PBKDF2
   • DSwitch to salted SHA-256 with a unique random salt per user
   Reveal Solution Discussion Select an answer first