Which of the following are used to increase the computing time it takes to brute force a password using an offline attack? (Select TWO)

XOR (exclusive OR) is a basic bitwise logical operation used in encryption and data manipulation, but it provides no inherent computational cost increase and is trivially fast for attackers to reverse.

PBKDF2 (Password-Based Key Derivation Function 2) applies a pseudorandom function thousands or millions of times (iterations) to a password and salt, dramatically increasing the CPU time required to test each password guess in an offline brute-force attack.

bcrypt is an adaptive password hashing function that incorporates a cost factor (work factor), allowing administrators to increase computational complexity over time; this intentional slowness makes it extremely resistant to offline brute-force and dictionary attacks.

HMAC (Hash-based Message Authentication Code) is used for verifying message integrity and authenticity using a secret key, but it is not designed to be computationally expensive and does not slow down password brute-forcing.

RIPEMD is a cryptographic hash function designed for speed and integrity verification, not for password storage; its efficiency makes it unsuitable for defending against brute-force attacks since it can be computed very quickly.