Understanding Passwords GCIH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a primary benefit of using a password manager?

   • AIt generates and stores strong, unique passwords for each account
   • BIt allows users to reuse the same password across all sites
   • CIt eliminates the need for multi-factor authentication
   • DIt stores passwords in plaintext for easy access
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is updating its password policy. The current policy requires 8-character passwords with at least one uppercase letter, one number, and one special character. The security team wants to improve resistance to brute-force attacks while minimizing user frustration. Which policy change is most effective?

   • ARequire passwords to be changed every 30 days.
   • BKeep the 8-character minimum but add a requirement for two special characters.
   • CImplement a password blacklist of common passwords.
   • DIncrease the minimum length to 12 characters and remove the complexity requirements.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A developer is building a web application and needs to store user passwords. The developer is considering using the MD5 hash algorithm with a unique salt for each user. A security reviewer flags this as insufficient. What is the primary reason MD5 with salt is considered a weak choice for password storage?

   • AMD5 is a broken algorithm that can be reversed to recover the original password
   • BMD5 is too fast, allowing an attacker to test billions of password guesses per second
   • CMD5 does not support the use of salts
   • DMD5 produces a 128-bit hash, which is too short to be secure
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An attacker has obtained a database of password hashes. The hashes were created with a fast algorithm and each hash includes a unique salt. Which cracking technique will be most effective?

   • AUse a dictionary attack with a wordlist, applying the salt to each candidate.
   • BPerform a brute-force attack on each hash individually.
   • CUse a rainbow table that includes the salt values.
   • DLook up the hashes in an online database of precomputed hashes.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization is implementing MFA for remote access. The security team wants to choose a method that is resistant to phishing and does not require users to carry a separate physical token. Which MFA method best meets these requirements?

   • AWebAuthn using a built-in platform authenticator (e.g., Windows Hello or Touch ID)
   • BPush notifications to a mobile app
   • CSMS one-time passcodes
   • DEmail-based one-time passcodes
   Reveal Solution Discussion Select an answer first