What setup should an administrator use for regularly testing the strength of user passwords?

The correct answer is C. A standalone workstation on which the password database is copied and processed by the. Password strength testing (using cracking tools) must be done on a standalone (isolated, non-networked) workstation using a copy of the password hash database. This prevents: (1) network exposure of the cracking activity or the hash database, and (2) the cracking tool consuming…

Submitted by parkjh· Apr 18, 2026Security Operations and Administration

Question

What setup should an administrator use for regularly testing the strength of user passwords?

Options

AA networked workstation so that the live password database can easily be accessed by the
BA networked workstation so the password database can easily be copied locally and
CA standalone workstation on which the password database is copied and processed by the
DA password-cracking program is unethical; therefore it should not be used.

How the community answered

(49 responses)

A
6% (3)
B
4% (2)
C
71% (35)
D
18% (9)

Explanation

Password strength testing (using cracking tools) must be done on a standalone (isolated, non-networked) workstation using a copy of the password hash database. This prevents: (1) network exposure of the cracking activity or the hash database, and (2) the cracking tool consuming production system resources. A networked workstation (A or B) creates risk of interception or unauthorized access to the cracking results. Option D is incorrect - authorized, internal password auditing is an ethical and necessary security practice when done with proper authorization.

Topics

#Password auditing#Security best practices#Data isolation#Vulnerability testing

Community Discussion

No community discussion yet for this question.

Full SSCP Practice