SY0-701 General Security Concepts Practice Question
A user database is stolen from a SaaS portal. Investigators discover the password column contains the same value for every user who chose "Summer2026!", and an attacker could use precomputed tables to crack weak passwords quickly. Which change best addresses both the repeated-value issue and rainbow-table risk?
⚠ Common exam trap
CompTIA often tests the misconception that encryption (A) or a stronger hash like SHA-256 (B) is sufficient for password storage, but the trap is that encryption is reversible and unsalted hashes are still vulnerable to rainbow tables, whereas the correct answer requires both salting and an adaptive, slow hash function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store each password with a unique salt and an adaptive hash such as bcrypt or Argon2
Using a unique salt per password ensures that even if two users choose the same password (e.g., 'Summer2026!'), their stored hashes will differ, eliminating the repeated-value issue. Additionally, adaptive hash functions like bcrypt or Argon2 are computationally expensive, making precomputed rainbow tables infeasible even if the salts were known, as each guess requires re-hashing with the specific salt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt all stored passwords with AES and keep one shared key
Why it's wrong here
Encrypting passwords with AES and a single shared key is reversible cryptography: any attacker who obtains the key (or exploits a key-management weakness) can decrypt every password. It also provides no protection against identical plaintexts, since encrypting the same password with the same key and IV yields the same ciphertext, letting attackers spot common passwords. This approach is fundamentally different from one-way hashing, which is intended to make recovery infeasible.
- ✗
Use SHA-256 without a salt
Why it's wrong here
Using unsalted SHA-256 produces a deterministic output: the same password always yields the same hash, so attackers can precompute rainbow tables or simply compare target hashes against known password hashes. Without a salt, two users with the same password will have identical stored values, directly revealing password reuse. Furthermore, SHA-256 is fast by design, giving attackers no meaningful resistance when trying billions of guesses per second offline.
- ✓
Store each password with a unique salt and an adaptive hash such as bcrypt or Argon2
Why this is correct
A unique salt prevents two users with the same password from producing the same stored value, which makes identical passwords harder to spot. Salting also defeats rainbow-table attacks because precomputed hashes no longer match. An adaptive hash adds deliberate computational cost, slowing offline cracking after a breach. Together, these are the standard protections for password storage.
- ✗
Add a digital signature to each password record
Why it's wrong here
A digital signature provides authentication and integrity for data—it proves who signed the record and that it hasn't been altered—but it does nothing to protect the password value itself. If a password is stored in plaintext or with a recoverable encoding, an attacker in possession of the database can still read it directly; the signature only ensures the record wasn't tampered with, not that its contents are secret. Digital signatures are therefore a misuse of cryptographic mechanisms for password storage, which requires one-way, salted, adaptive hashing.
Go deeper
Related to this question
Learn chapter
Hashing Algorithms
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?
easy- A.Store the passwords in plain text so users can recover them easily.
- ✓ B.Hash the passwords with a unique salt for each account.
- C.Encrypt the passwords and keep the decryption key in the same database.
- D.Compress the passwords before storing them to make them smaller.
Why B: Hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.