nerdexam
CompTIA

CAS-002 · Question #118

A database administrator comes across the below records in one of the databases during an internal audit of the payment system: UserIDAddressCredit Card No.Password jsmith123 fake…

The correct answer is A. Concern: Passwords are stored in plain text. Storing passwords in plain text is the greatest concern because it allows any attacker who breaches the database to immediately use every user's credentials without any further computational effort.

Enterprise Security

Question

A database administrator comes across the below records in one of the databases during an internal audit of the payment system:

UserIDAddressCredit Card No.Password jsmith123 fake street55XX-XXX-XXXX-1397Password100 jqdoe234 fake street42XX-XXX-XXXX-202717DEC12 From a security perspective, which of the following should be the administrator's GREATEST concern, and what will correct the concern?

Options

  • AConcern: Passwords are stored in plain text.
  • BConcern: User IDs are also usernames, and could be enumerated, thereby disclosing
  • CConcern: User IDs are confidential private information.
  • DConcern: More than four digits within a credit card number are stored.

How the community answered

(49 responses)
  • A
    73% (36)
  • B
    6% (3)
  • C
    4% (2)
  • D
    16% (8)

Why each option

Storing passwords in plain text is the greatest concern because it allows any attacker who breaches the database to immediately use every user's credentials without any further computational effort.

AConcern: Passwords are stored in plain text.Correct

Plain text password storage means a single database compromise directly exposes all user credentials, enabling immediate account takeover across the entire user base. Passwords must be stored as salted cryptographic hashes using algorithms such as bcrypt, scrypt, or Argon2 so that even if the database is stolen, recovering the original passwords is computationally infeasible. The records shown - 'Password100' and '17DEC12' - confirm that passwords are stored in clear text, violating both security best practices and compliance standards such as PCI-DSS.

BConcern: User IDs are also usernames, and could be enumerated, thereby disclosing

Username enumeration is a low-severity concern because usernames without usable password hashes provide minimal attack value compared to the immediate, high-impact risk of fully exposed plain text passwords.

CConcern: User IDs are confidential private information.

User IDs are system-generated reference identifiers that are not inherently confidential private information and are commonly exposed in non-sensitive application contexts.

DConcern: More than four digits within a credit card number are stored.

The credit card numbers in the records are masked to display only the last four digits in an XX-XXX-XXXX-format, which is consistent with PCI-DSS truncation requirements and does not represent a compliance violation as displayed.

Concept tested: Password storage security - hashing versus plain text

Source: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

Topics

#password storage#PCI-DSS#database security#plaintext credentials

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice