Password Cracking Techniques and Countermeasures ECSS Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is testing the password policy of a web application. The application stores passwords as salted hashes. The analyst has a wordlist of common passwords and wants to crack passwords that follow the pattern of a common word followed by two digits (e.g., 'summer99', 'winter01'). Which attack technique is most efficient for this specific pattern?

   • ADictionary attack using only the wordlist without modifications
   • BRainbow table attack using precomputed tables for the salted hashes
   • CHybrid attack that appends two digits to each word in the wordlist
   • DPure brute-force attack trying all alphanumeric combinations
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a security assessment, a penetration tester extracts a database of password hashes. The hashes are unsalted MD5 values. The tester wants to recover as many plaintext passwords as possible in the shortest time, knowing that many users choose common words with simple substitutions. Which approach should the tester prioritize?

   • ABuild a rainbow table for the entire 8-character printable ASCII keyspace
   • BCrack only hashes that match a known pattern using a mask attack limited to 'password' variants
   • CRun a pure brute-force attack over all 8-character lowercase combinations
   • DUse a dictionary attack with a wordlist of common passwords, then apply rule-based mutations
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which password storage mechanism is considered the most secure among the following?

   • AStoring passwords using reversible encryption
   • BStoring passwords as salted hashes
   • CStoring passwords in plaintext
   • DStoring passwords as unsalted hashes
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is migrating from a legacy system that stores passwords as unsalted SHA-1 hashes to a modern system using bcrypt. The migration must not force all users to reset their passwords immediately. Which approach best balances security and user experience?

   • AKeep the SHA-1 hashes and add a pepper to them
   • BOn next successful login, rehash the plaintext password with bcrypt and a unique salt, then delete the old SHA-1 hash
   • CStore both the old SHA-1 hash and a new bcrypt hash for each user, and verify against the old hash until the user logs in
   • DRehash all passwords immediately using bcrypt with a static salt
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company's IT department discovered that an attacker obtained the password hash database from their authentication server. The hashes are salted and use a strong hashing algorithm. The IT manager wants to implement additional countermeasures to reduce the risk of successful password cracking. Which countermeasure would be most effective in this situation?

   • ARequire users to change passwords immediately and use multi-factor authentication
   • BImplement account lockout after 5 failed login attempts
   • CEnforce a minimum password length of 8 characters
   • DAdd a pepper to the hashing process going forward
   Reveal Solution Discussion Select an answer first