A security team is evaluating the password policy for a high-security system. They need to balance usability and security. The current policy requires 8-character passwords with complexity. The team is considering increasing the minimum length to 12 characters. Which analysis best explains the security benefit of this change?

Increasing length makes passwords easier to remember, reducing the likelihood of users writing them down.

Increasing length prevents dictionary attacks because common words are usually short.

Increasing length exponentially increases the keyspace for brute force attacks, making them significantly more time-consuming.

Increasing length eliminates the need for salting because longer passwords are inherently secure.

Why is a brute force attack generally more feasible against a 4-digit PIN than against a 12-character password?

The PIN is stored in plaintext, while the password is hashed.

The PIN has a much smaller keyspace, so fewer combinations need to be tried.

The PIN uses only numbers, which are easier to guess than letters.

The PIN is not salted, while the password is salted.

Why are rainbow table attacks generally ineffective against salted password hashes?

The salt is a secret key that is required to decrypt the hash.

The salt changes the hash output, so precomputed tables for unsalted hashes do not match.

The salt encrypts the hash, making it unreadable to the rainbow table algorithm.

The salt increases the length of the hash, making it too large for the table.

What is the primary function of John the Ripper?

To exploit vulnerabilities in web applications.

To capture network traffic and analyze protocols.

To scan networks for open ports and services.

To crack password hashes using various attack modes such as dictionary and brute force.

A database administrator discovers that a legacy application stores passwords using a single global salt for all users. The administrator wants to migrate to a more secure storage method. Which change would most improve resistance to rainbow table attacks?

Increase the global salt length

Use a unique random salt for each password

Store the salt separately from the hash

EC-CouncilEthical Hacking Essentials

Domain 2Objective 4

Password Cracking Techniques EHE Practice Questions (Page 5)

Part of the Malware and Password Attacks domain, which makes up ~14% of our current practice bank.

42questions here

9free pages

10concepts

Questions 21–25

21expert · hard
A security team is evaluating the password policy for a high-security system. They need to balance usability and security. The current policy requires 8-character passwords with complexity. The team is considering increasing the minimum length to 12 characters. Which analysis best explains the security benefit of this change?
Select an answer first
22foundation · easy
Why is a brute force attack generally more feasible against a 4-digit PIN than against a 12-character password?
Select an answer first
23foundation · easy
Why are rainbow table attacks generally ineffective against salted password hashes?
Select an answer first
24foundation · easy
What is the primary function of John the Ripper?
Select an answer first
25application · medium
A database administrator discovers that a legacy application stores passwords using a single global salt for all users. The administrator wants to migrate to a more secure storage method. Which change would most improve resistance to rainbow table attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.