GCIH Understanding Passwords Practice Question
An incident handler is investigating a breach where an attacker gained access to a system that uses a password manager. The password manager stores all user passwords in an encrypted vault protected by a single master password. The attacker was able to extract the encrypted vault and is now attempting to crack the master password offline. Which of the following characteristics of the password manager's key derivation function would most significantly increase the attacker's difficulty?
⚠ Common exam trap
The trap here is focusing on the encryption algorithm (AES-256) or hardware protection (HSM) when the primary defense against offline master password cracking is the key derivation function's memory-hardness and iteration count.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using a high iteration count with a memory-hard function like Argon2id.
The key derivation function used to transform the master password into an encryption key is critical. A memory-hard function like Argon2id with a high iteration count requires large amounts of memory and CPU time per guess, making offline brute-force attacks impractical. This significantly increases the cost for the attacker, even with specialized hardware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Using a high iteration count with a memory-hard function like Argon2id.
Why this is correct
Argon2id is a memory-hard key derivation function that requires significant memory and CPU resources, making it highly resistant to GPU-based cracking. A high iteration count further increases the computational cost. This combination forces the attacker to expend substantial resources for each guessing attempt, dramatically slowing down offline cracking of the master password.
- ✗
Encrypting the vault with AES-256 in CBC mode.
Why it's wrong here
AES-256 is a strong encryption algorithm, but the attacker is not trying to break the encryption directly; they are trying to guess the master password that derives the encryption key. The strength of AES-256 is irrelevant if the master password is weak. The key derivation function is the bottleneck that slows down password guessing.
- ✗
Using a simple hash function like SHA-256 with a salt.
Why it's wrong here
SHA-256 with a salt is better than unsalted hashing, but it is still a fast hash that can be computed quickly on GPUs. It does not provide the same level of resistance to offline cracking as a memory-hard function like Argon2id. A high iteration count with SHA-256 would help, but memory-hardness is more effective.
- ✗
Storing the master password hash in a separate hardware security module (HSM).
Why it's wrong here
Storing the master password hash in an HSM can protect it from extraction, but in this scenario the attacker already extracted the encrypted vault. The HSM would not help if the vault is offline. The key derivation function's properties are what determine the difficulty of cracking the master password once the vault is obtained.
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.