Exam SY0-401 topic 3 question 225 discussion

Actual exam question from CompTIA's SY0-401

Question #: 225
Topic #: 3

[All SY0-401 Questions]

Which of the following password attacks is MOST likely to crack the largest number of randomly generated passwords?

A. Hybrid
B. Birthday attack
C. Dictionary
D. Rainbow tables

Show Suggested Answer

Suggested Answer: D 🗳️
When a password is "tried" against a system it is "hashed" using encryption so that the actual password is never sent in clear text across the communications line.
This prevents eavesdroppers from intercepting the password. The hash of a password usually looks like a bunch of garbage and is typically a different length than the original password. Your password might be "shitzu" but the hash of your password would look something like "7378347eedbfdd761619451949225ec1".
To verify a user, a system takes the hash value created by the password hashing function on the client computer and compares it to the hash value stored in a table on the server. If the hashes match, then the user is authenticated and granted access.
Password cracking programs work in a similar way to the login process. The cracking program starts by taking plaintext passwords, running them through a hash algorithm, such as MD5, and then compares the hash output with the hashes in the stolen password file. If it finds a match, then the program has cracked the password.
Rainbow Tables are basically huge sets of precomputed tables filled with hash values that are pre-matched to possible plaintext passwords. The Rainbow Tables essentially allow hackers to reverse the hashing function to determine what the plaintext password might be.
The use of Rainbow Tables allows for passwords to be cracked in a very short amount of time compared with brute-force methods, however, the trade-off is that it takes a lot of storage (sometimes Terabytes) to hold the Rainbow Tables themselves.
With a rainbow table, all of the possible hashes are computed in advance. In other words, you create a series of tables; each has all the possible two-letter, three- letter, four-letter, and so forth combinations and the hash of that combination, using a known hashing algorithm like SHA-2. Now if you search the table for a given hash, the letter combination in the table that produced the hash must be the password you are seeking.

by [deleted] at March 9, 2025, 5:18 a.m.

Comments

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!