Password Security and Credential Storage

Final Quiz

Connecting to LMS... Progress: in progress

Assessment

1. Why should plaintext passwords never be stored? A. Plaintext storage exposes user credentials directly if the database or logs are compromised B. Plaintext storage makes authentication safer C. Plaintext storage is required for password reset D. Plaintext storage replaces MFA

2. What is password hashing? A. A reversible encryption process for recovering passwords B. A one-way transformation used to store a password verifier instead of the original password C. A browser cookie setting D. A session timeout

3. Why are salts used? A. To make passwords visible to administrators B. To encrypt all database traffic C. To ensure identical passwords do not produce identical stored hashes and to resist precomputed attacks D. To replace password hashing

4. What is a work factor? A. A user interface theme B. A database table name C. An email template D. A tunable cost setting that controls how expensive password hashing is

5. Why are fast general-purpose hashes poor choices for password storage? A. Attackers can test guesses very quickly if hashes are cheap to compute B. They always include salts automatically C. They are impossible to brute force D. They replace account monitoring

6. Which algorithm is commonly used for modern password hashing? A. Base64 B. Argon2 C. ROT13 D. Plain SHA-1 for password storage

7. What is a pepper? A. A public username field B. A browser header C. An application-level secret sometimes used in addition to per-password salts D. A password reset email

8. Why use established password hashing libraries? A. Libraries make passwords plaintext B. Libraries remove the need for salts C. Libraries prevent all phishing D. Custom cryptography and custom password storage are easy to get wrong

9. What is credential stuffing? A. Trying reused username and password pairs from one breach against another service B. Encrypting credentials in transit C. Rotating database backups D. Creating unique salts

10. Why should login attempts be rate limited? A. To make passwords reversible B. To reduce automated guessing and credential stuffing pressure C. To replace MFA D. To disable logging

11. Why should password reset tokens be protected? A. They are always public B. They replace authentication permanently C. They can allow account takeover if stolen or guessed D. They should be logged for convenience

12. Why might sessions be invalidated after a password change? A. Password changes have no relationship to sessions B. Session invalidation weakens security C. Sessions are impossible to revoke D. Existing sessions may no longer reflect the user's intended account security state

13. What should developers check during code review? A. Passwords are not stored, logged, exposed, or compared unsafely B. Passwords are printed for debugging C. Password reset tokens never expire D. Hash parameters are ignored

14. What is rehashing on login? A. Recovering the plaintext password B. Updating a stored password hash to newer parameters after a successful authentication C. Disabling MFA D. Logging the password

15. Which statement best summarizes password storage? A. Store plaintext passwords for easy recovery B. Encrypt passwords so administrators can read them C. Store password verifiers using purpose-built hashing, unique salts, appropriate cost settings, and protected operational controls D. Use the fastest hash possible for convenience