AP Cybersecurity Drill 17: Password Storage and Login Attempts

Question 1. How many failed attempts occurred on jmoreno before the successful login?

• A) Two failed attempts appear in the log before the success
• B) Three failed attempts appear in the log before the success
• C) Four failed attempts appear in the log before the success ✓
• D) Five failed attempts appear in the log before the success

Explanation: Choice C is correct. The log lists failures at 08:01, 08:02, 08:03, and 08:04, which is four failed attempts, followed by a success at 08:06. Choice A is incorrect. Two undercounts the failed rows shown. Choice B is incorrect. Three also undercounts the failed rows. Choice D is incorrect. Five would have triggered the lockout, but the log shows only four failures and then a success.

Question 2. Did the account reach the lockout threshold during this log?

• A) No, because four failures is one short of the five-attempt lockout threshold here ✓
• B) Yes, because any single failed login immediately locks the account on its own
• C) Yes, because four failures within a few minutes always forces an automatic lockout
• D) No, because a successful login can never come after any failed attempt at all

Explanation: Choice A is correct. The policy locks the account on the fifth consecutive failure, and only four failures occurred before the success, so the threshold was not reached. Choice B is incorrect. A single failure does not lock the account under the stated rule. Choice C is incorrect. The count, not merely the timing, determines lockout, and four is below the limit. Choice D is incorrect. A success can follow failures, which is exactly what the log shows.

Question 3. Why does storing passwords as salted one-way hashes protect users if the database is stolen?

• A) The salt makes every stored password automatically expire after a fixed number of days
• B) The hash quietly emails a security alert to the user whenever it is read by anyone
• C) The salt encrypts the network traffic so login attempts cannot be captured in transit
• D) The hash is not feasibly reversible, and the salt blocks precomputed lookup tables ✓

Explanation: Choice D is correct. A one-way hash cannot be feasibly turned back into the original password, and a unique salt per user defeats precomputed lookup tables, so a stolen database does not hand over the passwords. Choice A is incorrect. Salting does not set an expiration on stored passwords. Choice B is incorrect. A hash is a stored value, not an alerting mechanism that emails anyone. Choice C is incorrect. Salting protects stored values, not data moving across the network, which is the job of transport encryption.

Question 4. Which change would most improve protection against someone who guesses jmoreno's password?

• A) Lower the lockout threshold so that a single wrong attempt fully disables the account
• B) Add a second factor, such as a one-time code from the user's phone, at login ✓
• C) Store the password in readable plain text so that the admin can verify it more easily
• D) Remove the symbol requirement to make the password simpler to recall

Explanation: Choice B is correct. Requiring a second factor means a guessed or stolen password alone is not enough to sign in, which directly addresses password guessing. Choice A is incorrect. Locking on one wrong attempt would constantly lock out legitimate users and invites denial of service. Choice C is incorrect. Plain-text storage removes protection rather than adding it. Choice D is incorrect. Dropping the symbol rule weakens the password instead of strengthening login.

Question 5. Does the proposed password SpringForge2024 satisfy the stated policy?

• A) No, it has no symbol even though it meets the length and other character rules ✓
• B) Yes, it meets every requirement including the symbol the policy calls for
• C) No, it is under the twelve-character minimum the policy sets for length
• D) Yes, because any password containing a four-digit year is automatically allowed

Explanation: Choice A is correct. SpringForge2024 is fifteen characters with upper-case, lower-case, and digits, but it contains no symbol, so it fails the policy on that one rule. Choice B is incorrect. It does not meet every rule, since the symbol is missing. Choice C is incorrect. At fifteen characters it clears the twelve-character minimum. Choice D is incorrect. Containing a year does not override the symbol requirement.