GSEC Access Control and Password Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Argon2

  Why this is correct

  Argon2 is the winner of the Password Hashing Competition and is designed to resist GPU cracking. It allows tuning of time cost (CPU), memory cost, and parallelism. This makes it highly adaptable to different hardware and security requirements. The scenario explicitly requires tuning of CPU and memory costs and resistance to GPU attacks, which Argon2 delivers. It is the recommended choice for new applications.

• ✗

  PBKDF2

  Why it's wrong here

  PBKDF2 applies a pseudorandom function (like HMAC-SHA256) many times to derive a key. It allows tuning of iteration count (CPU cost) but does not have a memory cost parameter. This makes it less resistant to GPU attacks compared to memory-hard functions. The requirement for tuning memory costs is not satisfied by PBKDF2, so it is not the optimal choice.

• ✗

  bcrypt

  Why it's wrong here

  bcrypt is a password hashing function based on the Blowfish cipher. It includes a cost factor that adjusts CPU time, making it resistant to brute-force attacks. However, bcrypt does not allow tuning of memory costs; it is primarily CPU-hard. The scenario requires tuning of both CPU and memory costs, which bcrypt does not provide. Therefore, it is not the best fit.

• ✗

  SHA-256 with a random salt

  Why it's wrong here

  SHA-256 is a fast cryptographic hash. Adding a salt prevents rainbow table attacks but does not slow down brute-force attempts. GPUs can compute SHA-256 hashes at extremely high rates, making it unsuitable for password storage. The requirement for resistance to GPU-accelerated cracking and tunable CPU/memory costs is not met by SHA-256, even with salting.