Which Technique Adds a Random String to a Password?
In order to strengthen a password and prevent a hacker from cracking it, a random string of 36 characters was added to the password. Which of the following best describes this technique?
Community Votes
71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the distinction between salting and key stretching; the trap is that key stretching also strengthens passwords but does so by iterating the hash, not by appending a random string.
Salting adds a random string to a password before hashing to defend against precomputed hash and rainbow table attacks. This page confirms why salting (D) is the best description of the 36-character random addition, not key stretching.
Choosing key stretching (A) because it also improves password security, but key stretching increases computational cost per guess, while the scenario explicitly adds a random string—the definition of salting.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Salting is the process of adding a random string—often called a salt—to a password before it is hashed. The scenario's 36-character random addition matches that definition exactly. A salt ensures that identical passwords produce different hashes, which defeats rainbow tables and precomputed dictionary attacks. The community's leading response is dbrowndiver's explanation that "Salting is the correct answer because it involves adding a random string" and chalaka similarly notes that the random string prevents precomputed hash databases. Shaman73 also concisely votes "D. Salting."Why the Other Options Are Wrong
Key stretching (A) is a related but distinct technique: it repeatedly hashes a password (or salted password) to increase the computational cost of each guess, such as with PBKDF2 or bcrypt. It does not, by definition, add a single random string to the password. Some study guides—like the SY0-601 guide quoted by Eracle—say key stretching appends random characters, but modern Security+ doctrine separates salting as the random-appending technique. Tokenization (B) replaces sensitive data with non-sensitive tokens for use in systems, and data masking (C) obscures data for display or testing; neither is used to strengthen a stored password by adding randomness.Community Comment Notes
The vote split (71 for D vs. 29 for A) shows this is a commonly confused pair. jsmthy defends key stretching by saying it increases resources per guess, but that misses the scenario's explicit random string. Eracle quotes an older SY0-601 guide that describes key stretching as appending random characters; that wording conflicts with standard cryptographic definitions and the current SY0-701 objective. VincentvdS points to a Mosse Institute article that clarifies the difference between key stretching and salting, and _tips breaks down salting versus key stretching in detail. The majority's choice of salting aligns with the standard definition.Official Reference
Exam Strategy
When you see 'random string added to a password', immediately map it to salting—the salt's purpose is uniqueness, not computational slowdown. Key stretching is about repeated hashing iterations; if the scenario doesn't mention iterations or work factor, don't pick it.
Frequently Asked Questions
Why is key stretching not the answer when it also strengthens passwords?
Key stretching iterates the hash to slow brute-force attacks, but the scenario explicitly adds a 36-character random string to the password, which is the definition of salting.
Does salting change the user's password length?
No, the salt is stored alongside the hash and is not part of the user's password; it makes each stored hash unique and defeats precomputed hash attacks.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →