Which of the following is a characteristic of a challenge/response authentication process?

Presenting distorted graphics of text describes CAPTCHA, which is a human-verification mechanism to distinguish bots from humans, not a challenge/response authentication protocol.

In a challenge/response authentication scheme, the server issues a random challenge value, and the client computes a hash using the challenge combined with the user's password or credential, then sends only the hash back. This proves knowledge of the password without ever transmitting it in plaintext, which is the defining characteristic of the protocol (e.g., CHAP, NTLM, or MS-CHAPv2).

Using a password history blacklist is a password policy control that prevents reuse of previous passwords, which is unrelated to the challenge/response authentication mechanism.

Requiring non-consecutive numeric characters is a password complexity rule enforced during password creation, not a characteristic of the challenge/response authentication process.