Password Cracking Countermeasures EHE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team is migrating a legacy application that stores passwords in plaintext. They want to choose a secure storage method that resists both offline brute-force and rainbow-table attacks. Which approach should they implement?

   • AStore the passwords in a separate database table with restricted access.
   • BUse Argon2id with a unique random salt per user and appropriate cost parameters.
   • CEncrypt the passwords with AES-256 using a hardcoded key in the application.
   • DUse MD5 with a global salt shared by all users.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst notices a large number of failed login attempts against a legacy application that stores passwords as salted SHA-1 hashes. The analyst wants to detect whether the attacker has successfully cracked any hashes and respond quickly. Which action should the analyst take first?

   • ARun a dictionary attack against the hash database to see if any passwords are weak.
   • BReview authentication logs for successful logins from unusual IP addresses or at unusual times.
   • CDisable the legacy application until the hashing algorithm is upgraded.
   • DImmediately change all users' passwords to a new 12-character value.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center (SOC) analyst is reviewing logs and sees a pattern: a single user account has had 50 failed login attempts over 10 minutes, followed by a successful login from a foreign IP address. The analyst needs to respond immediately. What is the most appropriate first action?

   • AIgnore the event because the successful login may have been the legitimate user traveling abroad.
   • BDisable the user account and force a password reset after verifying the user's identity.
   • CAdd the foreign IP address to a blocklist and continue monitoring.
   • DSend an email to the user asking if they just logged in from abroad.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is updating its password policy. The current policy requires 8 characters with complexity and forces a change every 90 days. The security team wants to align with current best practices. Which policy change is most aligned with modern recommendations?

   • AKeep the 8-character complexity requirement but change the rotation period to 30 days.
   • BRequire 10 characters with at least one special character and rotate every 60 days.
   • CRemove all complexity requirements and rely solely on MFA.
   • DRequire a minimum of 12 characters, allow passphrases, and only require rotation if there is evidence of compromise.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's remote workers use a VPN that requires only a username and password. After a phishing campaign targeted these workers, management wants to add a second authentication factor without purchasing new hardware tokens. Which option is most practical?

   • ARequire employees to answer personal security questions after entering their password.
   • BSend a one-time code via email to the employee's corporate address before allowing VPN access.
   • CIncrease the VPN password length to 20 characters and require a change every 30 days.
   • DEnroll employees' smartphones with a TOTP authenticator app and require the one-time code at VPN login.
   Reveal Solution Discussion Select an answer first