Exam CAS-004 topic 1 question 151 discussion

The request to enter specific characters of the password rather than the full password may be a security measure intended to make it more difficult for an attacker to gain access to the account by guessing the password. However, it also means that a potential attacker only needs to be able to guess or brute force three characters of the password rather than all 12 characters. In addition, the fact that the system is able to retrieve specific characters of the password suggests that the password is stored in a reversible format, which means that it can be read by anyone who has access to it

D to me is written wrong to be the correct answer. "The request proves a potential attacker only needs to be able to guess or brute force three characters rather than 12 characters of the password." If the login is requesting 3 characters and you are giving them 3 characters, that is 3 characters they would not have to brute force. They would have to brute force the remaining 9. Someone correct me if i am reading that answer wrong.

D. The request proves a potential attacker only needs to be able to guess or brute force three characters rather than 12 characters of the password. Correct. By requesting only specific characters, an attacker would need to guess or brute force only a subset of the password (e.g., 3 out of 12 characters), significantly reducing the complexity and increasing the vulnerability. E. The request proves the password is stored in a reversible format, making it readable by anyone at the bank who is given access. Correct. The fact that the system can request specific characters of the password implies that the password is stored in a reversible format (e.g., plain text or encrypted but reversible), which is a significant security concern. Secure systems typically store passwords in a hashed format that does not allow for easy extraction of individual characters.

why not CE? I dont see how this method is easy to bruteforce, assuming every time you log in, you are asked for different character positions. OR is this suggesting that 3., 8. and 11. character is asked EVERY single time? That'd be dumb.

I agree with D like the majority of everyone here, but I'm surprised no one here has considered F. In a secure system, passwords are typically hashed or encrypted on the client side (the device where the user is entering the password) before being transmitted to the server. However, when a system asks for specific characters of the password, it implies that the server needs to compare those characters directly with the stored password. This comparison cannot occur if the password is fully hashed or encrypted because the server wouldn't be able to retrieve the original password characters for the comparison. This leads me to believe that those specific characters are plaintext. Going with DF here, unless someone has more insight.

AD. peeps

I got the wrong at first but D and E seem correct.

but if you have to enter 3 characters and the password is 12 digits then there are still 9 characters unaccounted for. How would that make it D?

I'm going with A and D. D is self-explanatory, and here's my reasoning for A: Over time, if the same user is repeatedly prompted to input different characters from the password, an attacker using a keylogger may be able to piece together the entire password

D,E is the correct answer