SY0-701 General Security Concepts Practice Question
Exhibit
Database sample users.password_hash -------------------------------- alex 5f4dcc3b5aa765d61d8327deb882cf99 mira 202cb962ac59075b964b07152d234b70 sam 098f6bcd4621d373cade4e832627b4f6 Developer note: - Passwords are hashed before storage - The application does not currently store any salt values
Based on the exhibit, which change would most improve the security of the stored password data?
⚠ Common exam trap
Many candidates confuse hashing with encryption or assume that a 'modern' hash like SHA-256 is sufficient for password storage, overlooking the critical need for salting and key stretching to defend against brute-force and rainbow table attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a unique salt per password and use a slow password hashing algorithm.
Adding a unique salt per password prevents precomputed rainbow table attacks, and using a slow password hashing algorithm (like bcrypt, PBKDF2, or Argon2) increases the computational cost of brute-force attacks. This combination ensures that even if the password hashes are compromised, attackers cannot efficiently crack them. Salting also ensures that identical passwords produce different hashes, eliminating the ability to detect shared passwords across accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the passwords in encrypted form so they can be recovered later if needed.
Why it's wrong here
Encryption is a two-way operation: if an attacker obtains the encryption key — through a breach, misconfigured key vault, or insider threat — every stored password can be trivially decrypted back to plaintext. Password storage must be one-way so that even with full database access, an attacker cannot reverse the stored values. Moreover, using encryption implies the system has the ability to recover passwords, which is unnecessary and dangerous for authentication credentials.
- ✓
Add a unique salt per password and use a slow password hashing algorithm.
Why this is correct
Adding a unique random salt to each password before hashing ensures that two users with the same password produce completely different stored values, defeating precomputed rainbow tables and cross-user correlation. Pairing that salt with a deliberately slow, memory-hard password hashing algorithm such as Argon2id, scrypt, or bcrypt forces an attacker to spend significant CPU and memory for every single guess, making offline brute-force and dictionary attacks prohibitively expensive. The salt is stored in plaintext next to the hash and does not need to be secret — its purpose is to prevent parallel cracking and eliminate shortcut tables, while the algorithm's cost factor is what actually protects weak passwords.
- ✗
Replace the hash with a plain SHA-256 digest because it is modern and widely supported.
Why it's wrong here
SHA-256 is a fast general-purpose cryptographic hash designed for integrity checking, not for password storage. Without a per-password salt, identical passwords always produce identical digests, making them vulnerable to precomputed rainbow tables; even with a salt, SHA-256's speed (billions of hashes per second on consumer GPUs) lets an attacker try trillions of guesses per day. A 'modern' hash is not the same as a password-specific hash — password hashing algorithms intentionally add computational cost and memory usage, while SHA-256 deliberately minimizes them for performance.
- ✗
Append the application name to each password before hashing to make the hashes unique.
Why it's wrong here
Appending a fixed application name to every password is equivalent to using a constant, global salt: all users with the same password still generate the same hash, so an attacker can still build a single rainbow table or crack all accounts in one pass. A real salt must be unique per user, randomly generated for each account, and stored alongside the hash so that even within the same system, no two hashes are ever identical. This option does not prevent identical hashes for identical passwords, nor does it slow down the hashing operation, so it provides no meaningful protection against offline attacks.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Salting
Salting is the process of adding a unique, random string of data to each password before it is hashed, so that even identical passwords produce completely different hash values.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.