Understanding Passwords

An incident handler is investigating a breach where an attacker gained access to a system that uses a password manager. The password manager stores all user passwords in an encrypted vault protected by a single master password. The attacker was able to extract the encrypted vault and is now attempting to crack the master password offline. Which of the following characteristics of the password manager's key derivation function would most significantly increase the attacker's difficulty?

During an incident response engagement at a financial services firm, you discover that the attacker obtained a copy of the /etc/shadow file from a compromised Linux server. The file contains hashes generated with the SHA-512 crypt scheme ($6$). Which of the following is the MOST accurate assessment of the attacker's ability to recover plaintext passwords from these hashes?

What is the primary function of a salt in password storage?

An incident handler is investigating a compromised web application that stores user passwords using a custom hashing scheme. The application concatenates a user-specific salt with the password and then applies the SHA-256 hash function 10,000 times. The handler notices that the salt is only 4 bytes long and is generated using a predictable random number generator. Which of the following is the most significant weakness in this password storage scheme?

A GCIH incident handler is investigating a Windows 10 workstation compromised by an attacker who briefly gained local administrator access. The attacker ran a utility that extracted credential material while the machine was running, then left. The handler finds no suspicious files in the System32 directory, and the SAM and SYSTEM hives appear unmodified. However, the handler notices that the LSASS process was accessed by a process that is no longer running. Which of the following best describes what the attacker most likely obtained?

A security administrator is configuring a new web application and wants to implement a password hashing scheme that includes a pepper. Where should the pepper be stored to provide the intended security benefit?

Why does the use of pepper provide additional security for password hashes, and where should it ideally be stored?

An incident handler is analyzing a compromised Windows workstation and discovers that the attacker extracted password hashes from the SAM database. The handler wants to determine which types of attacks the attacker could perform using these hashes. (Choose two.)

Which TWO of the following are common indicators that a password database has been compromised?

Why are GPUs highly effective at cracking password hashes compared to traditional CPUs?

Which of the following describes a 'credential stuffing' attack?

Which TWO of the following are considered best practices for password hashing to mitigate offline cracking?

An incident handler is reviewing password storage mechanisms after a breach. The attacker exfiltrated a file containing password hashes. Which of the following TWO characteristics would make the hashes more resistant to offline cracking? (Choose two.)

An incident responder notices that a legacy web application stores user credentials using MD5 hashing without salt. Which vulnerability is the primary risk during a credential database compromise?

Which of the following is an advantage of using a Key Derivation Function (KDF) like Argon2 over a simple hash like SHA-256?

A security analyst is examining a Linux system that uses shadow password files. The analyst notices that the password hashes are stored in /etc/shadow and are prefixed with $6$. Which of the following best describes the hashing algorithm used for these passwords?

Which of the following scenarios best demonstrates why multi-factor authentication (MFA) is superior to password-only authentication?

A junior incident handler is reviewing password storage practices for a legacy application. The application stores passwords as unsalted MD5 hashes. Which of the following best describes the primary risk introduced by the lack of salting?