Ethical Hacking Essentials Practice Test

Which practice should be followed to protect web applications against broken authentication attacks?

1. Implement encryption

2. Apply pass phrasing with at least five random words

3. Use CAPTCHA

4. Limit access to sensitive areas

The correct answer is: Apply pass phrasing with at least five random words

The practice of applying pass phrasing with at least five random words is a strong method to enhance the security of web applications against broken authentication attacks. Passphrases, especially when consisting of multiple random words, can significantly increase the complexity and length of user passwords compared to simpler passwords or phrases. This increased complexity makes it much harder for attackers to use brute force or dictionary attacks to compromise accounts. Additionally, passphrases can often be easier for users to remember than complex passwords, encouraging better user behavior regarding password selection and usage. When users adopt strong authentication mechanisms, it strengthens the overall security of web applications against vulnerabilities associated with broken authentication. In terms of the other practices mentioned, while they are important for security, they do not directly address broken authentication as effectively. Encryption helps protect data in transit but does not prevent authentication issues. Using CAPTCHA can prevent automated login attempts but is typically not foolproof against all forms of credential stuffing or account takeover. Limiting access to sensitive areas is a vital security measure, but it does not specifically mitigate the risks associated with user authentication failures or weak credentials themselves.