A small business stores customer passwords in a database. An auditor finds that the passwords are stored as reversible ciphertext using a hard-coded key in the application source code. Which recommendation best addresses the security issue while maintaining the ability to authenticate users?

Use a stronger encryption algorithm like AES-256 with a key management service

Keep encryption but rotate the hard-coded key regularly

Add a salt to the encrypted passwords

Switch to salted, one-way hashes and require a password reset for all users

A security team is designing a password storage system. They need to resist both offline brute-force attacks and precomputed rainbow table attacks, while also ensuring that the system can scale to millions of users. Which combination of properties is most important?

A fast hash function with a global salt

A slow hash function without salt

A slow, salted hash function with a unique salt per user

You are testing a web application that stores passwords as unsalted MD5 hashes. You want to demonstrate the risk of this practice by cracking a specific user's password quickly. Which attack strategy is most efficient for this scenario?

Run a dictionary attack with a wordlist and rule-based mutations

Use a precomputed rainbow table for MD5

Use a hybrid attack combining a wordlist and a small set of common suffixes

Perform a brute-force attack over all 8-character combinations

During an incident response, you find a database with password hashes that are 32 hexadecimal characters long. You also find a configuration file that mentions 'MD5' and 'salt'. Which of the following is the most likely explanation?

The hashes are NTLM hashes with a salt

The hashes are SHA-1 hashes with a salt

The hashes are bcrypt hashes with a salt

The hashes are MD5 hashes with a salt prepended or appended to the password before hashing

GIAC Penetration Tester (GPEN)

Domain 3Objective 1

Password Formats and Hashes GPEN Practice Questions (Page 2)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 6–10

6foundation · easy
A penetration tester extracts a hash that is 32 hexadecimal characters long. Which hash algorithm is most likely being used?
Select an answer first
7application · medium
A small business stores customer passwords in a database. An auditor finds that the passwords are stored as reversible ciphertext using a hard-coded key in the application source code. Which recommendation best addresses the security issue while maintaining the ability to authenticate users?
Select an answer first
8expert · hard
A security team is designing a password storage system. They need to resist both offline brute-force attacks and precomputed rainbow table attacks, while also ensuring that the system can scale to millions of users. Which combination of properties is most important?
Select an answer first
9application · medium
You are testing a web application that stores passwords as unsalted MD5 hashes. You want to demonstrate the risk of this practice by cracking a specific user's password quickly. Which attack strategy is most efficient for this scenario?
Select an answer first
10expert · hard
During an incident response, you find a database with password hashes that are 32 hexadecimal characters long. You also find a configuration file that mentions 'MD5' and 'salt'. Which of the following is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.