Question 4
NECO
•
2024
•
DATA_PROCESSING
•
objective
An organization requires passwords of length 8 characters. Each character can be an uppercase letter (26), a lowercase letter (26), a digit (10) or a special symbol (12). The policy mandates that a password contain at least one uppercase letter, one digit and one special symbol. \n\n(a) How many distinct passwords satisfy the policy? \n\n(b) If an attacker can test \(10^{6}\) passwords per second and the average time to crack a password is half the size of the key‑space, does the policy meet the security standard that the average cracking time must exceed 5 years? \n\n(c) Briefly discuss the ethical issue of storing passwords in plain text.
Answer Options
A.
(a) Approximately 4.31×10^{13} passwords. (b) No - average cracking time ≈2.5 years, far below the 5‑year standard. (c) Storing passwords in plain text is ethical because it allows users to retrieve forgotten passwords easily.
Correct Answer
B.
(a) Approximately 4.31×10^{14} passwords. (b) Yes - average cracking time ≈6.8 years, which exceeds 5 years. (c) Storing passwords in plain text is unethical because it breaches confidentiality and puts users at risk; passwords should be stored as salted hashes.
C.
(a) Approximately 5.0×10^{14} passwords. (b) Yes - average cracking time ≈5.2 years, which barely meets the 5‑year requirement. (c) Storing passwords in plain text is permissible as long as users are informed, though hashing is recommended for convenience.
D.
(a) Approximately 3.2×10^{14} passwords. (b) No - average cracking time ≈4.2 years, which is less than 5 years. (c) Storing passwords in plain text is acceptable if the system uses strong firewalls; it does not pose a major ethical concern.
Correct Answer
B
Correct Option:
(a) Approximately 4.31×10^{14} passwords. (b) Yes - average cracking time ≈6.8 years, which exceeds 5 years. (c) Storing passwords in plain text is unethical because it breaches confidentiality and puts users at risk; passwords should be stored as salted hashes.
About This Question
This is
Neco
2024
Data Processing
Question 4.
It is one of the
objective
questions from the
2024
Neco
Data Processing
examination.
Difficulty level:
Hard
.