Quick Answer
The answer is to implement a strong one-way hashing algorithm such as bcrypt. This is the best remediation because reversible encryption relies on a key that, if compromised, allows an attacker to decrypt every stored password in the database, whereas bcrypt is a computationally expensive, salted hash that makes password recovery mathematically infeasible even after a breach. On the CISA exam, this concept tests your understanding of cryptographic controls and the critical distinction between encryption and hashing for password storage; a common trap is confusing encryption (which is reversible) with hashing (which is one-way). To remember this, think of the mnemonic “Encrypt to protect data in transit, hash to protect passwords at rest”—and for bcrypt specifically, recall that its built-in salt and adaptive cost factor directly resist rainbow tables and brute-force attacks, making it the gold standard for password storage remediation.
This CISA practice question tests your understanding of protection of information assets. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During a penetration test, a tester discovers that an application stores passwords using a reversible encryption algorithm. Which of the following is the BEST remediation?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Use MD5 hashing with a salt
Why wrong: MD5 is considered weak.
Replace the encryption algorithm with AES-256
Why wrong: Encryption is reversible; hashing is preferred.
Implement a strong one-way hashing algorithm such as bcrypt
bcrypt is designed for password storage.
Add a random salt before encryption
Why wrong: Salt with encryption still reversible.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Implement a strong one-way hashing algorithm such as bcrypt
Storing passwords using reversible encryption is fundamentally flawed because any encryption key can be compromised, allowing an attacker to decrypt all passwords. The best remediation is to use a strong, one-way hashing algorithm like bcrypt, which is designed to be computationally expensive and includes a built-in salt to resist rainbow table attacks and brute-force attempts. Unlike encryption, hashing is irreversible, so even if the database is breached, the original passwords cannot be recovered.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Use MD5 hashing with a salt
Why it's wrong here
MD5 is considered weak.
Replace the encryption algorithm with AES-256
Why it's wrong here
Encryption is reversible; hashing is preferred.
Implement a strong one-way hashing algorithm such as bcrypt
Why this is correct
bcrypt is designed for password storage.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Add a random salt before encryption
Why it's wrong here
Salt with encryption still reversible.
Common exam traps
The trap here is that candidates confuse encryption with hashing, thinking that a strong encryption algorithm like AES-256 is sufficient for password storage, when in fact any reversible method is insecure for this purpose.
Detailed technical explanation
Bcrypt uses the Blowfish cipher's key schedule to create a slow, adaptive hash function; its cost factor can be increased over time to keep pace with faster hardware. Under the hood, bcrypt incorporates a 128-bit salt and iterates the key expansion process thousands of times (e.g., 2^10 rounds by default), making each password guess computationally expensive. In a real-world scenario, an attacker who dumps a bcrypt-hashed password database would need to spend years of GPU time to crack even moderately strong passwords, whereas encrypted passwords could be bulk-decrypted in seconds if the key is found.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A practitioner preparing for the CISA exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Protection of Information Assets — study guide chapter
Learn the concepts, then practise the questions
Protection of Information Assets practice questions
Targeted practice on this topic area only
All CISA questions
509 questions across all exam domains
Certified Information Systems Auditor CISA study guide
Full concept coverage aligned to exam objectives
CISA practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise CISA questions linked to Governance and Management of IT.
Practise CISA questions linked to Information Systems Acquisition, Development and Implementation.
Practise CISA questions linked to Information Systems Operations and Business Resilience.
Practise CISA questions linked to Protection of Information Assets.
Practise CISA questions linked to Information System Auditing Process.
Practise CISA questions linked to CISA fundamentals.
Practise CISA questions linked to CISA scenario.
Practise CISA questions linked to CISA troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Protection of Information Assets — This question tests Protection of Information Assets — Read the scenario before looking for a memorised answer..
The correct answer is: Implement a strong one-way hashing algorithm such as bcrypt — Storing passwords using reversible encryption is fundamentally flawed because any encryption key can be compromised, allowing an attacker to decrypt all passwords. The best remediation is to use a strong, one-way hashing algorithm like bcrypt, which is designed to be computationally expensive and includes a built-in salt to resist rainbow table attacks and brute-force attempts. Unlike encryption, hashing is irreversible, so even if the database is breached, the original passwords cannot be recovered.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.