Ethical Hacking: Penetration Testing Methodology Quiz

Quiz: Passwords and Access

Pass mark: 70%. You can retry as many times as you need.

1 Why does hashing a password not make a weak, common password safe? Single answer Because hash functions can always be mathematically reversed Because guessing and hashing a common candidate password is fast and will match if it is correct Because hashing only applies to passwords longer than twelve characters

2 What problem does salting specifically solve? Single answer It encrypts the password so it can be decrypted by the server when needed It prevents users from ever choosing a weak password It makes precomputed-table attacks impractical by making each user's hash unique

3 Which statements about online versus offline password guessing are correct? (several answers) Multiple answers possible Online guessing can trigger account lockouts affecting real users Offline guessing requires no interaction with the live system during the guessing itself Online guessing never needs explicit client agreement since it only tries passwords Offline guessing can only be performed without ever obtaining any hash

4 Why is a pass-the-hash issue not fixed simply by requiring very long, random passwords? Single answer Because pass-the-hash attacks rely on reusing a derived value, not on guessing the original password Because long passwords always produce weaker hashes Because pass-the-hash only affects systems with no passwords at all

5 Why might an extremely strict account lockout policy (locking an account for 24 hours after one failed attempt) be a poor recommendation? Single answer Because it would make multi-factor authentication unnecessary Because it can be deliberately abused to lock out legitimate users Because lockout policies have no effect on password guessing attacks