A web application stores user passwords in a database. During a review, you find that the password column contains values like 'P@ssw0rd' in plaintext. What is the most immediate security concern?

The passwords are vulnerable to rainbow table attacks

The passwords cannot be used for authentication because they are not hashed

Anyone with database read access can directly see the passwords

The passwords are encrypted with a weak algorithm

GIAC Penetration Tester (GPEN)

Domain 3Objective 1

Password Formats and Hashes GPEN Practice Questions (Page 4)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 16–20

16application · medium
You are explaining to a client why a small change in a password (e.g., changing 'Password1' to 'Password2') produces a completely different hash. Which property of cryptographic hash functions does this demonstrate?
Select an answer first
17foundation · easy
A penetration tester finds a database column named 'password' that contains entries like 'P@ssw0rd123' and 'Summer2024!'. Which storage format is most likely in use?
Select an answer first
18foundation · easy
A hash begins with the prefix '$2y$'. Which hashing algorithm does this prefix indicate?
Select an answer first
19application · medium
A web application stores user passwords in a database. During a review, you find that the password column contains values like 'P@ssw0rd' in plaintext. What is the most immediate security concern?
Select an answer first
20application · medium
You are analyzing a captured hash that is 40 characters long and starts with the hex characters `5baa61e4`. Which algorithm is this most likely to be?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Password Formats and Hashes GPEN Practice Questions (Page 4)

Questions 16–20

You are explaining to a client why a small change in a password (e.g., changing 'Password1' to 'Password2') produces a completely different hash. Which property of cryptographic hash functions does this demonstrate?

A penetration tester finds a database column named 'password' that contains entries like 'P@ssw0rd123' and 'Summer2024!'. Which storage format is most likely in use?

A hash begins with the prefix '$2y$'. Which hashing algorithm does this prefix indicate?

A web application stores user passwords in a database. During a review, you find that the password column contains values like 'P@ssw0rd' in plaintext. What is the most immediate security concern?

You are analyzing a captured hash that is 40 characters long and starts with the hex characters `5baa61e4`. Which algorithm is this most likely to be?

Keep studying — Password Attacks and Credential Attacks