SY0-701 General Security Concepts Practice Question
A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?
⚠ Common exam trap
Test-takers frequently confuse encryption with hashing, thinking that encrypting passwords is sufficient, but they overlook that reversible encryption with the key stored alongside the data provides no real protection in a database theft scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hash the passwords with a unique salt for each account.
Hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the passwords in plain text so users can recover them easily.
Why it's wrong here
Storing passwords as plain text eliminates any barrier between an attacker and the raw credential data. If the database is ever exfiltrated, every password is immediately readable without any additional effort, enabling instant account takeover. The convenience of letting users recover their passwords does not justify leaving sensitive data completely exposed, and password storage must assume the database may be compromised.
- ✓
Hash the passwords with a unique salt for each account.
Why this is correct
Hashing with a unique salt makes password data much harder to reuse or crack at scale. If the database is stolen, the attacker cannot directly read the passwords, and identical passwords will not produce the same stored value when salts differ.
- ✗
Encrypt the passwords and keep the decryption key in the same database.
Why it's wrong here
Encrypting passwords with a key stored in the same database is fundamentally flawed because encryption is a reversible process. An attacker who steals the database also likely obtains the decryption key, allowing them to recover all plaintext passwords with trivial effort. Unlike one-way hashing, encryption is designed for confidentiality when the key is separately protected, so co-locating the key and ciphertext provides no real security.
- ✗
Compress the passwords before storing them to make them smaller.
Why it's wrong here
Compression merely reduces the size of the stored data and does not alter its readability or security properties. An attacker who gains access to the compressed database can still decompress the data and obtain the plaintext passwords without any resistance. Compression is a storage optimization technique, not a security control, and it fails to protect against either direct disclosure or offline cracking attempts.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
Key term
Rainbow table
A rainbow table is a precomputed list of password hashes used to reverse weak passwords quickly without guessing each one live.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.