PEN-200 Password Attacks Practice Question
Which of the following describes the risk associated with using a password manager that lacks a master password and relies solely on local file encryption?
⚠ Common exam trap
Candidates often assume that local file encryption is sufficient for security. They ignore that if the master key is stored in memory or a predictable location, it can be easily extracted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The encryption keys are stored in a predictable location or memory, allowing for easy extraction.
Password managers are designed to consolidate credentials, but they are only as secure as their master secret. Without a master password, the vault relies on the security of the host filesystem. If an attacker gains local access or performs a memory dump, the keys are easily extractable. This concept is vital for understanding how credential storage mechanisms can be exploited when the primary authentication factor is absent or bypassed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The vault is vulnerable to dictionary attacks due to the lack of a salt in the local file.
Why it's wrong here
While dictionary attacks are a concern, the lack of a master password is the primary issue. The local encryption mechanism usually involves a hardcoded or derived key from system artifacts, which an attacker can find without needing to perform a dictionary attack against the database file itself.
- ✓
The encryption keys are stored in a predictable location or memory, allowing for easy extraction.
Why this is correct
When a master password is not required, the application must derive the decryption key from static sources, such as registry keys, machine GUIDs, or environment variables. An attacker with access to the system can easily locate these sources to decrypt the vault, rendering the 'encryption' effectively transparent to them.
- ✗
The lack of a master password prevents the use of multi-factor authentication for the vault.
Why it's wrong here
Multi-factor authentication is a separate mechanism from the password vault's local encryption. While not having a master password is bad, it does not strictly prevent the implementation of MFA, although it would be highly unusual to offer MFA on a system that doesn't require a master password.
- ✗
The file format will be incompatible with standard password cracking software like John the Ripper.
Why it's wrong here
Compatibility with cracking software is irrelevant if the key can be obtained through other means. In this scenario, the attacker would not need to crack the file; they would simply extract the key from the host, making the password manager's file format entirely irrelevant to the success of the theft.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.