Which Technique Adds a Random String to a Password?

SY0-701 By islever Editorial Last updated

Explain the importance of using appropriate cryptographic solutions.

Short answer

D Salting adds a random string to the password before hashing, which is exactly the 36-character random addition described.

Question

In order to strengthen a password and prevent a hacker from cracking it, a random string of 36 characters was added to the password. Which of the following best describes this technique?
  1. Key stretching
  2. Tokenization
  3. Data masking
  4. Salting Correct Answer

Key Takeaways

Tests the distinction between salting and key stretching; the trap is that key stretching also strengthens passwords but does so by iterating the hash, not by appending a random string.

Salting adds a random string to a password before hashing to defend against precomputed hash and rainbow table attacks. This page confirms why salting (D) is the best description of the 36-character random addition, not key stretching.

Common mistake: Choosing key stretching (A) because it also improves password security, but key stretching increases computational cost per guess, while the scenario explicitly adds a random string—the definition of salting.

Expert Analysis

Why the Answer Is Correct

Salting is the process of adding a random string—often called a salt—to a password before it is hashed. The scenario's 36-character random addition matches that definition exactly. A salt ensures that identical passwords produce different hashes, which defeats rainbow tables and precomputed dictionary attacks. The community's leading response is dbrowndiver's explanation that "Salting is the correct answer because it involves adding a random string" and chalaka similarly notes that the random string prevents precomputed hash databases. Shaman73 also concisely votes "D. Salting."

Why the Other Options Are Wrong

Key stretching (A) is a related but distinct technique: it repeatedly hashes a password (or salted password) to increase the computational cost of each guess, such as with PBKDF2 or bcrypt. It does not, by definition, add a single random string to the password. Some study guides—like the SY0-601 guide quoted by Eracle—say key stretching appends random characters, but modern Security+ doctrine separates salting as the random-appending technique. Tokenization (B) replaces sensitive data with non-sensitive tokens for use in systems, and data masking (C) obscures data for display or testing; neither is used to strengthen a stored password by adding randomness.

Community Comment Notes

The vote split (71 for D vs. 29 for A) shows this is a commonly confused pair. jsmthy defends key stretching by saying it increases resources per guess, but that misses the scenario's explicit random string. Eracle quotes an older SY0-601 guide that describes key stretching as appending random characters; that wording conflicts with standard cryptographic definitions and the current SY0-701 objective. VincentvdS points to a Mosse Institute article that clarifies the difference between key stretching and salting, and _tips breaks down salting versus key stretching in detail. The majority's choice of salting aligns with the standard definition.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see 'random string added to a password', immediately map it to salting—the salt's purpose is uniqueness, not computational slowdown. Key stretching is about repeated hashing iterations; if the scenario doesn't mention iterations or work factor, don't pick it.

Frequently Asked Questions

Why is key stretching not the answer when it also strengthens passwords?

Key stretching iterates the hash to slow brute-force attacks, but the scenario explicitly adds a 36-character random string to the password, which is the definition of salting.

Does salting change the user's password length?

No, the salt is stored alongside the hash and is not part of the user's password; it makes each stored hash unique and defeats precomputed hash attacks.

More SY0-701 FAQ →

Community Votes

D
71%
A
29%

71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. dbrowndiver 👍 12 Answered D
    Salting is the correct answer because it involves adding a random string to a password before hashing to strengthen security. This technique effectively prevents precomputed hash attacks, making it a critical component of modern password protection strategies.
  2. jsmthy 👍 4 Answered A
    Key stretching techniques are used to make a possibly weak key, typically a password or passphrase, more secure against a brute-force attack by increasing the resources it takes to test each possible key. Salting does not add to the length of the password and does not stop attackers from brute-forcing the key as the salt is added after the password is submitted. Tokenization and Data masking will not prevent brute-force attacks for the same reason. They are processes that don't alter a weak password.
  3. chalaka 👍 2 Answered D
    D. Salting Explanation: Salting involves adding a random string (called a salt) to a password before it is hashed to prevent attackers from using precomputed hash databases (like rainbow tables) to crack the password. The random string (in this case, 36 characters) is unique and makes the password significantly harder to guess because it ensures that even if two users have the same password, their hashes will be different.
  4. Eracle 👍 2 Answered A
    Why not A? From CompTIA Security+ SY0-601 Certification Guide : "Key stretching is where you append a random set of characters to a password to increase the size of the password and its hash, ensuring that a brute-force attack needs more compute time to crack the password."
  5. _tips 👍 1 Answered A
    Salting Adds a random string of characters, called a "salt", to a password before hashing it. This makes each password unique and prevents attackers from: Using dictionary lookups to see how popular passwords are hashed Guessing the hash function to unlock a database of passwords Key stretching Lengthens the password by iterating the hash of the salted password. This makes it much more difficult for attackers to crack passwords using brute-force or precomputed tables.
Show 2 more comments
  1. VincentvdS 👍 1 Answered D
    Salting is correct. Read the difference between Salting and Key Stretching on : https://library.mosse-institute.com/articles/2023/07/key-stretching-and-saltingm.html It explains a lot.
  2. Shaman73 👍 2 Answered D
    D. Salting

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide