Password Cracking Techniques EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security engineer is evaluating password policies for a high-security system. The goal is to make brute-force attacks infeasible. Which policy is most effective at increasing the time required for a brute-force attack?

   • ARequire a minimum password length of 12 characters
   • BRequire at least one uppercase letter and one digit
   • CRequire passwords to be changed every 30 days
   • DBlock common passwords from a list
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is implementing a new password storage system for its web application. The security team wants to protect against both rainbow table attacks and brute force attacks. Which combination of measures is most effective?

   • AUse a strong hashing algorithm like bcrypt with a unique salt for each password.
   • BUse MD5 with a global salt for all passwords.
   • CStore passwords in plaintext but enforce a strong password policy.
   • DUse SHA-256 without salt but enforce a minimum password length of 12 characters.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the main advantage of a rainbow table attack over a traditional brute force attack?

   • AIt works without needing the password hash.
   • BIt can crack any password regardless of length.
   • CIt is immune to salting.
   • DIt can reverse hashes much faster because the hash chains are precomputed.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A forensic analyst has recovered a database of unsalted MD5 hashes from a legacy system. The analyst needs to recover as many passwords as possible within a few hours. The analyst has access to a large rainbow table set for MD5 and a powerful GPU workstation. Which strategy should the analyst use?

   • AUse only a GPU-based dictionary attack with a large wordlist
   • BUse the rainbow tables first, then fall back to a GPU-based brute-force attack for remaining hashes
   • CUse a hybrid attack with a small wordlist
   • DUse only a CPU-based brute-force attack over 7 characters
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary factor that determines the time required for a brute force attack to succeed?

   • AThe number of users in the system
   • BThe length and complexity of the password
   • CThe operating system of the target system
   • DThe hashing algorithm used to store the password
   Reveal Solution Discussion Select an answer first