A company's authentication database was breached, and attackers obtained password hashes. The hashes were generated with bcrypt using a cost factor of 4 and no salt. The security team is evaluating the damage. Which statement is most accurate?

The hashes are secure because bcrypt is memory-hard and cannot be cracked with GPUs.

Bcrypt is a strong algorithm, so the hashes are safe regardless of the cost factor.

The missing salt is the only issue; the cost factor is irrelevant.

The low cost factor and missing salt make the hashes significantly easier to crack, especially for common passwords.

A development team is building a new web application and wants to store user passwords securely. The compliance team requires that passwords be resistant to offline cracking even if the database is leaked. Which storage approach should the team use?

Store passwords in plaintext but restrict database access to the application server only.

Encrypt passwords with AES-256 using a key stored in the application's configuration file.

Hash each password with a unique random salt using Argon2id with a high work factor.

Hash passwords with SHA-256 and a single global salt.

Why is it important to add a unique salt to each password before hashing?

To allow the password to be recovered if the user forgets it

To encrypt the password with a secret key

To make the hash longer and more difficult to store

To ensure that identical passwords produce different hash values

A security analyst is reviewing logs and notices that a single user account has had 500 failed logon attempts over the past hour, followed by a successful logon. The account has MFA enabled, and the successful logon was completed with a valid MFA code. What is the most likely explanation?

The log is inaccurate and the successful logon was actually the user's normal login.

The user simply mistyped their password 500 times and then succeeded.

The MFA code was not required because the account is exempt from MFA.

The attacker guessed the password and also obtained the MFA code, possibly through a phishing attack or MFA fatigue.

What is the purpose of auditing password-related events in an organization?

To automatically block all users who fail to change passwords

To ensure that passwords are stored in plain text for compliance

To eliminate the need for multi-factor authentication

To review and analyze login activity to identify potential security incidents

EC-CouncilEthical Hacking Essentials

Domain 2Objective 5

Password Cracking Countermeasures EHE Practice Questions (Page 3)

Part of the Malware and Password Attacks domain, which makes up ~14% of our current practice bank.

44questions here

9free pages

7concepts

Questions 11–15

11expert · hard
A company's authentication database was breached, and attackers obtained password hashes. The hashes were generated with bcrypt using a cost factor of 4 and no salt. The security team is evaluating the damage. Which statement is most accurate?
Select an answer first
12application · medium
A development team is building a new web application and wants to store user passwords securely. The compliance team requires that passwords be resistant to offline cracking even if the database is leaked. Which storage approach should the team use?
Select an answer first
13foundation · easy
Why is it important to add a unique salt to each password before hashing?
Select an answer first
14expert · hard
A security analyst is reviewing logs and notices that a single user account has had 500 failed logon attempts over the past hour, followed by a successful logon. The account has MFA enabled, and the successful logon was completed with a valid MFA code. What is the most likely explanation?
Select an answer first
15foundation · easy
What is the purpose of auditing password-related events in an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.