What practices help secure web application authentication mechanisms? (Choose two)

Question

Options

• AUsing salted password hashes
• BEnabling directory listing
• CLimiting session timeout durations
• DUsing CAPTCHA for login forms

• A
  69% (20)
• B
  10% (3)
• C
  21% (6)

Explanation

Salted password hashes (A) protect stored credentials by combining a unique random value with each password before hashing, ensuring that even identical passwords produce different hash outputs and thwarting rainbow table attacks. CAPTCHA on login forms (D) defends against automated brute-force and credential-stuffing attacks by requiring human verification before login proceeds. Enabling directory listing (B) is a vulnerability, not a security control - it exposes file structures and sensitive paths to attackers. Limiting session timeout (C) is partially backward: shorter timeouts improve security, but "limiting" the duration is ambiguous and this is not a primary authentication mechanism - it's a session management control.

Memory tip: Think "A = Authenticate safely (hash+salt), D = Defend the door (CAPTCHA)." Both act directly at the point of credential entry or storage, which is the defining trait of authentication security controls.

No community discussion yet for this question.