Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company's application stores user passwords. Their security team says passwords must be stored as hashes, never in plaintext. They want to ensure this requirement is met even if a database is compromised. Why is password hashing (with salt) the correct approach?
⚠ Common exam trap
Test-takers frequently confuse encryption (which is reversible) with hashing (which is one-way), or assume that cloud encryption alone satisfies the requirement, ignoring the application's own storage logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashing with salt makes stored passwords irreversible — even if the database is stolen, attackers cannot recover the original passwords without computationally intensive per-user brute force.
Password hashing with salt is the correct approach because it transforms passwords into irreversible digests. Even if the database is compromised, an attacker cannot recover the original passwords without performing a computationally expensive brute-force attack on each salted hash individually. This ensures the plaintext password is never stored or recoverable, meeting the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hashing passwords allows the application to recover the original password when users forget it.
Why it's wrong here
Hashing is a one-way mathematical function: once a password is transformed into its hash digest, there is no feasible algorithm to reverse it back to the original plaintext. For this reason, 'Forgot password' flows cannot and do not reveal the original password—instead they generate a time-limited reset link or one-time passcode that lets the user set a new password, relying on the fact that the old hash is irreversible.
- ✓
Hashing with salt makes stored passwords irreversible — even if the database is stolen, attackers cannot recover the original passwords without computationally intensive per-user brute force.
Why this is correct
Salted hashing converts a password into a fixed-length digest using a random per-user salt, making the stored value irreversible and preventing attackers from using precomputed rainbow tables to reverse many hashes at once. Even after a database breach, an attacker must guess or brute-force each user's password independently and recompute the hash with that user's salt, a computationally expensive process that becomes infeasible for strong, high-entropy passwords—thereby protecting users even when other security layers fail.
- ✗
Storing passwords as hashes allows sharing them between systems for single sign-on.
Why it's wrong here
Password hashes are not interchangeable credentials between systems because each system typically uses its own unique salt and hashing parameters, so the same password produces different hashes in different databases. Single sign-on (SSO) is achieved through identity federation protocols such as SAML or OIDC, where an identity provider issues signed tokens or assertions about the user's identity—never by sharing password hashes, which would also increase the blast radius of a credential theft.
- ✗
Google Cloud automatically encrypts all database contents, making password hashing unnecessary.
Why it's wrong here
Google Cloud's managed services offer encryption at rest and in transit, but that protects data from physical disk theft and network eavesdropping, not from authorized database users or applications with read access. If passwords are stored as plaintext and the database is merely encrypted, a database administrator or an attacker with stolen credentials can still read the actual passwords; application-layer hashing ensures the original secrets are never available in plaintext to anyone, including the database team, providing defense in depth.
Go deeper
Related to this question
Learn chapter
Security on Google Cloud
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.