Access Control & Password Management GSEC Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A developer proposes storing user passwords as unsalted SHA-256 hashes. The security team rejects this. Which alternative should they recommend?

   • AEncrypt passwords with AES and store the key on the same server
   • BUse unsalted MD5 for speed
   • CUse salted bcrypt with a unique salt per user
   • DUse salted SHA-256 with a global salt
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Why do many password policies include a maximum password age (expiration) requirement?

   • ATo prevent users from reusing old passwords
   • BTo reduce the storage space needed for password hashes
   • CTo limit the window of opportunity if a password is compromised
   • DTo ensure passwords are complex enough
   Reveal Solution Discussion Select an answer first
3. 38foundation · easy

   How do password managers typically protect stored credentials?

   • ABy using a simple obfuscation algorithm that can be reversed
   • BBy sending passwords to a remote server without encryption
   • CBy storing passwords in plaintext on the user's device
   • DBy encrypting the password vault with a key derived from the user's master password
   Reveal Solution Discussion Select an answer first