A web application developer is choosing a password storage method. The developer is considering using bcrypt with a cost factor of 12. A security reviewer asks why bcrypt is preferred over SHA-256 for password storage. What is the primary reason?

bcrypt is a one-way hash function, while SHA-256 is reversible

bcrypt automatically salts passwords, while SHA-256 does not support salts

bcrypt is designed to be computationally expensive, slowing down brute-force attacks

bcrypt produces a longer hash than SHA-256, making it harder to crack

A company is evaluating password managers for its employees. The security team is comparing a cloud-based password manager and a locally-hosted password manager. What is a key security advantage of a locally-hosted password manager?

It is not vulnerable to phishing attacks

It is easier to deploy and manage for a large organization

It automatically syncs passwords across all devices

It stores passwords only on the user's device, reducing the risk of a cloud breach

A company has been hit by a phishing campaign that harvested employee passwords. Even after resetting passwords, management wants to reduce the impact of future credential theft. Which additional control would be most effective?

Provide security awareness training on identifying phishing emails.

Deploy hardware security keys that require physical presence for authentication.

Require users to change passwords every 60 days.

Implement a web filter that blocks known phishing domains.

A company is implementing MFA for all employees. The security team is concerned about phishing-resistant authentication but also needs to support employees who travel internationally and may not have reliable cellular service. Which MFA method is the best choice?

Hardware security keys (e.g., FIDO2 tokens)

Mobile authenticator app with push notifications

How does a password manager typically protect the stored password database?

By using a master password to encrypt the vault

By sending passwords to a remote server without encryption

By storing passwords in a plaintext file on the local disk

By using the same password for all accounts

GIAC Certified Incident Handler

Domain 4Objective 2

Understanding Passwords GCIH Practice Questions (Page 7)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 31–35

31application · medium
A web application developer is choosing a password storage method. The developer is considering using bcrypt with a cost factor of 12. A security reviewer asks why bcrypt is preferred over SHA-256 for password storage. What is the primary reason?
Select an answer first
32application · medium
A company is evaluating password managers for its employees. The security team is comparing a cloud-based password manager and a locally-hosted password manager. What is a key security advantage of a locally-hosted password manager?
Select an answer first
33application · medium
A company has been hit by a phishing campaign that harvested employee passwords. Even after resetting passwords, management wants to reduce the impact of future credential theft. Which additional control would be most effective?
Select an answer first
34expert · hard
A company is implementing MFA for all employees. The security team is concerned about phishing-resistant authentication but also needs to support employees who travel internationally and may not have reliable cellular service. Which MFA method is the best choice?
Select an answer first
35foundation · easy
How does a password manager typically protect the stored password database?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.