Which of the following can be used as a countermeasure to the rainbow password attack?

A salt is a random value appended or prepended to a password before it is hashed, ensuring that two identical passwords produce completely different hash outputs. Because rainbow tables are built on pre-computed hash-to-plaintext mappings for unsalted inputs, a unique salt per user invalidates any pre-existing table. This forces an attacker to recompute a separate table for every possible salt value, which is computationally infeasible.

Using alphanumeric characters increases password entropy but does not prevent rainbow attacks because tables can be pre-computed for any character set given sufficient resources.

Hashing alone without a salt is precisely what rainbow tables are designed to crack, as the table maps known hash values directly back to their plaintext equivalents.

An 8-character password is short and still vulnerable to rainbow table lookups if the hash was computed without a salt, regardless of length.