Password Formats and Hashes GPEN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer proposes storing passwords as SHA-256 hashes without salt. You must convince them to add a unique salt per user. Which argument best explains the security benefit?

   • ASalting makes the hash function non-deterministic, so the same password never hashes the same way twice
   • BSalting prevents dictionary attacks by making each password unique
   • CSalting ensures that identical passwords produce different hashes, defeating precomputed rainbow tables
   • DSalting increases the length of the hash, making it harder to store
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A developer is implementing a password reset feature. The system currently stores passwords as plaintext in a database. The developer wants to migrate to a secure storage format without requiring users to reset their passwords. Which approach is feasible?

   • AEncrypt the plaintext passwords with a key and store the ciphertext
   • BHash the plaintext passwords with a per-user salt and store the hashes
   • CHash the plaintext with MD5 without salt
   • DStore the plaintext as-is and add a salt column
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You find a hash in a configuration file that is 64 hexadecimal characters long and appears to be salted. Which algorithm is most likely being used?

   • ASHA-1
   • BSHA-256
   • CMD5
   • DNTLM
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A penetration tester is examining a hash that is 64 hexadecimal characters long and appears to be unsalted. The tester needs to determine if it is SHA-256 or SHA-512. Which observation would best differentiate the two?

   • ASHA-256 produces 64 hex characters; SHA-512 produces 128 hex characters
   • BBoth produce the same length, so they cannot be differentiated by length
   • CThe presence of a salt determines the algorithm
   • DSHA-256 produces 128 hex characters; SHA-512 produces 64 hex characters
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security engineer is evaluating a password storage scheme. The scheme uses a hash function that produces the same output for the same input every time, but changing one bit in the password changes roughly half the bits in the output. Which two properties of cryptographic hash functions does this scheme demonstrate?

   • AAvalanche effect and collision resistance
   • BDeterminism and preimage resistance
   • CPreimage resistance and collision resistance
   • DDeterminism and avalanche effect
   Reveal Solution Discussion Select an answer first