Password Cracking Countermeasures EHE Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A company is updating its password policy. The security team wants to maximize resistance to offline cracking while minimizing user frustration and help-desk calls. The current policy requires 8-character passwords changed every 60 days. Which policy change best meets these competing goals?

   • ARequire 14-character passphrases, remove forced periodic rotation, and enable breach-password screening.
   • BRequire 12-character passwords and force rotation every 30 days.
   • CRequire 10-character passwords with maximum complexity and keep the 60-day rotation.
   • DRequire 8-character passwords but add a mandatory password manager for all employees.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which password policy requirement most directly increases the time needed for a brute-force attack to succeed?

   • ARequiring passwords to be at least 12 characters long
   • BRequiring at least one special character
   • CRequiring users to change passwords every 90 days
   • DProhibiting the use of the username in the password
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which combination of practices represents the most effective general defense against password cracking attacks?

   • AEnforcing strong password policies, using salted hashes, implementing MFA, and monitoring login attempts
   • BDisabling password changes and relying on biometric authentication only
   • CRelying solely on complex passwords and changing them every 30 days
   • DUsing a firewall and antivirus software to block all external access
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security auditor finds that a legacy application stores passwords as unsalted MD5 hashes. The auditor must recommend a remediation that balances security improvement with the need to keep the application running. Which recommendation is the best first step?

   • AAdd a global salt to the existing MD5 hashes without changing the algorithm.
   • BMigrate to salted bcrypt hashes and force a password reset for all users during the migration.
   • CEncrypt the MD5 hashes with a hardware security module (HSM) key.
   • DDouble-hash the existing MD5 hashes with SHA-256.
   Reveal Solution Discussion Select an answer first