1. Home
2. All questions
3. Question 77

CISSP study material · question 77 of 500

An identity team is replacing an unsalted SHA-256 password store for a new consumer application. Policy demands a scheme that resists offline cracking on rented GPUs and lets defenders raise the attacker's cost as hardware improves. Following OWASP's 2025 cryptographic guidance, which choice should the team make?

• Software security
• Security engineering

1. Store passwords as HMAC-SHA-256 digests keyed by a secret pepper held in the application config.
2. Store passwords with salted SHA-256, re-hashing the digest a fixed one thousand times in application code.
3. Encrypt passwords with AES-256 so a stolen database yields no directly usable credential material.
4. Store passwords with Argon2, tuning its memory and iteration parameters to a defensible work factor.

Challenge yourself on this topic → Study as cards