Access Control & Password Management GSEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security auditor discovers that a legacy application stores user passwords using unsalted MD5 hashes. The auditor also notes that many users have the same password. What is the most significant risk?

   • AThe application will crash if too many users log in simultaneously
   • BUsers cannot reset their passwords because the hashes are not reversible
   • CAn attacker can use precomputed rainbow tables to quickly reverse the hashes and recover passwords
   • DThe hashes can be decrypted using the application's private key
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A security auditor finds that the application stores passwords in plaintext. Which risk is the most direct consequence?

   • APasswords are more likely to be guessed by users
   • BPasswords cannot be changed by users
   • CPasswords can be read by anyone with database access
   • DPasswords will expire automatically
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security engineer is evaluating password storage options for a new application. The application must support high login throughput, but the security team requires strong protection against offline attacks. Which approach best balances these concerns?

   • AUse SHA-256 with a unique salt for each user
   • BUse AES-256 encryption with a key stored in a hardware security module (HSM)
   • CUse bcrypt with a cost factor that is as high as possible while still meeting the application's performance requirements
   • DUse plaintext storage but restrict database access to a single server
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   An organization wants to implement MFA for remote access. Which combination represents two different authentication factors?

   • AFingerprint and facial recognition
   • BPassword and a one-time code sent via SMS
   • CSmart card and a USB security key
   • DPassword and a security question answer
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An employee uses a password manager to store credentials for multiple corporate applications. The employee's laptop is stolen, but the password manager requires a master password and biometric authentication. What is the primary security benefit of this setup?

   • AThe vault remains encrypted and inaccessible without the master password and biometric factor
   • BThe password manager automatically changes all passwords after the theft
   • CThe thief cannot access the laptop because the hard drive is encrypted
   • DThe password manager stores passwords in the cloud, so they are not on the laptop
   Reveal Solution Discussion Select an answer first