A web application stores passwords using a salted hash. The developer argues that because each password is salted, rainbow table attacks are completely impossible. Which response is most accurate?

Salting makes rainbow table attacks completely impossible because each salt is unique

Salting only protects against dictionary attacks, not rainbow tables

Salting prevents precomputed rainbow tables for the entire database, but attackers can still build a custom rainbow table for a specific salt if they know it

Salting is only effective if the salt is kept secret

During a Windows penetration test, you extract the local SAM database and find entries like `Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::`. What is the second hash (the 32-character value after the first colon pair) and what attack is it most vulnerable to?

NTLM hash; vulnerable to pass-the-hash attacks

SHA-1 hash; vulnerable to dictionary attacks

LM hash; vulnerable to rainbow table attacks

MD5 hash; vulnerable to brute force

You are analyzing a captured hash that appears as `$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy`. Which hash algorithm and characteristic is most likely correct?

bcrypt with a cost factor of 10

During an engagement, you capture a Windows authentication challenge. The response is a 16-byte value that you suspect is an NTLM hash. Which characteristic confirms this?

The value is exactly 32 hexadecimal characters and is derived from the NT hash of the password

The value is 16 hexadecimal characters and is derived from MD5 of the password

The value is 40 hexadecimal characters and is derived from SHA-1 of the password

The value is 64 hexadecimal characters and is derived from SHA-256 of the password

GIAC Penetration Tester (GPEN)

Domain 3Objective 1

Password Formats and Hashes GPEN Practice Questions (Page 6)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 26–30

26foundation · easy
Which hash algorithm is commonly used in Windows for storing password hashes in the SAM database and is based on the MD4 hash function?
Select an answer first
27application · medium
A web application stores passwords using a salted hash. The developer argues that because each password is salted, rainbow table attacks are completely impossible. Which response is most accurate?
Select an answer first
28application · medium
During a Windows penetration test, you extract the local SAM database and find entries like `Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::`. What is the second hash (the 32-character value after the first colon pair) and what attack is it most vulnerable to?
Select an answer first
29application · medium
You are analyzing a captured hash that appears as `$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy`. Which hash algorithm and characteristic is most likely correct?
Select an answer first
30application · medium
During an engagement, you capture a Windows authentication challenge. The response is a 16-byte value that you suspect is an NTLM hash. Which characteristic confirms this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.