hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Needs to select a hashing algorithm for storing…
A security engineer needs to select a hashing algorithm for storing user passwords in a database. Which of the following is the most secure choice?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
bcrypt
(bcrypt) is correct because bcrypt is specifically designed for password hashing with a cost factor to resist brute-force attacks. Option A (SHA-256) is fast and suitable for data integrity, not password storage. Option B (MD5) is cryptographically broken and susceptible to collision attacks. Option D (SHA-1) is also weak and deprecated for security use. Option E (PBKDF2) is a good password hashing function, but bcrypt is often preferred due to its built-in salt and adaptive cost factor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SHA-256
Why it's wrong here
SHA-256 is fast and suitable for data integrity, but its speed makes it vulnerable to brute-force attacks; not recommended for password storage.
- ✗
MD5
Why it's wrong here
MD5 is broken and easily reversed; it should never be used for passwords.
- ✓
bcrypt
Why this is correct
bcrypt is correct: it includes a salt and adaptive cost, making it resistant to brute-force and rainbow table attacks.
- ✗
SHA-1
Why it's wrong here
SHA-1 is weak and deprecated due to collision vulnerabilities; not secure for password hashing.
- ✗
PBKDF2
Why it's wrong here
PBKDF2 is a key derivation function, not a dedicated password hashing algorithm; it lacks a built-in memory-hardness mechanism, making it vulnerable to GPU-accelerated brute-force attacks that the correct choice resists via high memory bandwidth requirements. It is tempting because PBKDF2 is widely used for deriving encryption keys from passwords in protocols like WPA2, where computational cost alone suffices, but the scenario demands resistance to parallel hardware attacks.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.