CAS-001 · Question #119
A database administrator comes across the below records in one of the databases during an internal audit of the payment system: UserID Address Credit Card No. Password jsmith 123 fake street…
The correct answer is A. Concern: Passwords are stored in plain text. The correct answer is A. The greatest security concern is that passwords are stored in plain text (e.g., 'Password100', '17DEC12'). Plain text password storage means that anyone with database access - including insiders, attackers who breach the database, or administrators…
Question
A database administrator comes across the below records in one of the databases during an internal audit of the payment system:
UserID Address Credit Card No. Password jsmith 123 fake street 55XX-XXX-XXXX-1397 Password100 jqdoe 234 fake street 42XX-XXX-XXXX-2027 17DEC12 From a security perspective, which of the following should be the administrator's GREATEST concern, and what will correct the concern?
Options
- AConcern: Passwords are stored in plain text.
- BConcern: User IDs are also usernames, and could be enumerated, thereby disclosing sensitive account
- CConcern: User IDs are confidential private information.
- DConcern: More than four digits within a credit card number are stored.
How the community answered
(29 responses)- A79% (23)
- B7% (2)
- C3% (1)
- D10% (3)
Explanation
The correct answer is A. The greatest security concern is that passwords are stored in plain text (e.g., 'Password100', '17DEC12'). Plain text password storage means that anyone with database access - including insiders, attackers who breach the database, or administrators - can immediately read every user's password. Passwords must be stored as salted cryptographic hashes (e.g., bcrypt, Argon2) so that even database compromise does not expose credentials. The correction is to hash all passwords with a strong, salted hashing algorithm. While the partial credit card exposure (option D) is also a concern (PCI-DSS requires masking), plain text passwords represent a more immediate and widespread credential compromise risk across all accounts. Options B and C are valid concerns but are less critical than exposed passwords.
Topics
Community Discussion
No community discussion yet for this question.