Study. uk . com
  1. Home
  2. All questions
  3. Question 263

CompTIA Security+ study material · question 263 of 611

How must a verifier store passwords so they resist offline attack?

  1. Hashed with SHA-256 and a random salt
  2. Encrypted with an approved symmetric algorithm
  3. Stored in a hardware security module in plaintext
  4. Salted and hashed with a purpose-built password hashing scheme with a tunable cost factor
Show the answer

Answer: D. Salted and hashed with a purpose-built password hashing scheme with a tunable cost factor

The cost factor is what makes each guess expensive. A fast hash such as SHA-256 is unsuitable however it is salted.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 3.1.1.2 Verifier Requirements

Challenge yourself on this topic → Study as cards