Your company uses a legacy application that stores passwords as unsalted MD5 hashes. You are asked to improve security without changing the application. Which control is most effective at mitigating offline cracking if the hash database is leaked?

Add a global salt to all hashes in the database.

Encrypt the hash database with a hardcoded key.

Enforce a strong password policy that requires long, complex passwords.

Use a faster hashing algorithm like SHA-256.

GIAC Penetration Tester (GPEN)

Domain 3Objective 3

Attacking Password Hashes GPEN Practice Questions (Page 7)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 31–31

31application · medium
Your company uses a legacy application that stores passwords as unsalted MD5 hashes. You are asked to improve security without changing the application. Which control is most effective at mitigating offline cracking if the hash database is leaked?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Attacking Password Hashes GPEN Practice Questions (Page 7)

Questions 31–31

Your company uses a legacy application that stores passwords as unsalted MD5 hashes. You are asked to improve security without changing the application. Which control is most effective at mitigating offline cracking if the hash database is leaked?

Keep studying — Password Attacks and Credential Attacks