Study. uk . com
  1. Home
  2. All questions
  3. Question 533

CompTIA Security+ study material · question 533 of 611

A pepper is compromised. Why can it not simply be rotated?

  1. Because peppers are stored in hardware security modules
  2. Because the hash algorithm would need replacing
  3. Because changing it requires knowing each user's password, so all affected users must reset
  4. Because the salt would also have to change
Show the answer

Answer: C. Because changing it requires knowing each user's password, so all affected users must reset

The stored hash mixes the pepper with a password the verifier no longer has, so the value cannot be recomputed.

Source: OWASP Password Storage Cheat Sheet (OWASP) — OWASP Password Storage Cheat Sheet › Common requirements for peppering strategies

Challenge yourself on this topic → Study as cards