How Do You Limit Breach Impact on a Log-in Database?

SY0-701 By islever Editorial Last updated

Compare and contrast concepts and strategies to protect data. Explain the importance of using appropriate cryptographic solutions.

Short answer

B Hash the log-in database credentials so a breach exposes only one-way password digests instead of usable passwords.

Question

An organization wants to limit potential impact to its log-in database in the event of a breach. Which of the following options is the security team most likely to recommend?
  1. Tokenization
  2. Hashing Correct Answer
  3. Obfuscation
  4. Segmentation

Key Takeaways

The test is whether you map 'log-in database' to the standard password-protection control — hashing — rather than to the general containment phrase 'limit the impact of a breach,' which tempts candidates toward segmentation.

An organization asking how to limit breach impact on its log-in database is being pointed at password storage, and hashing is the control that keeps stolen credentials unusable. This page explains why one-way hashing (B) beats tokenization, obfuscation, and network segmentation for a credential store under SY0-701.

Common mistake: Many candidates choose D (segmentation) because the stem echoes the textbook definition of segmentation — isolating components to limit breach impact — but the question names a log-in database, and segmentation does not neutralize the credentials themselves once that segment is reached.

Expert Analysis

Why the Answer Is Correct

The stem names the asset: the log-in database, meaning the store of user IDs and password verifiers. CompTIA's data-protection doctrine is that passwords must never be stored in plaintext or reversibly encrypted; they are stored as salted, one-way hashes so that a stolen copy of the database yields digests that cannot be reversed into working credentials. That is exactly what 'limit potential impact in the event of a breach' means for this asset — the breach still happens, but the extracted data has no authentication value. As dbrowndiver explains, when passwords are hashed the database stores only hash values, so 'even if the database is breached, the attackers cannot easily obtain the original passwords.' Ty13 draws the same line cleanly: tokenization and format-preserving schemes are for card data that must remain retrievable, while 'Hashing is for log-in databases and such where you need to secure the info.' B is therefore the recommendation a security team would actually make, and it aligns with NIST and OWASP guidance on storing memorized-secret verifiers.

Why the Other Options Are Wrong

A (tokenization) is designed for data that must be recovered later, such as PANs in a payment flow; the token is meaningless outside the tokenization vault, but you cannot authenticate a user by comparing a token, and you would still need a verifier for the credential. The commenter a4e15bd argues tokenization keeps the real data 'stored securely elsewhere,' which actually proves the point — the value must be retrievable, exactly what you do not want for passwords. C (obfuscation) is a broad umbrella that includes masking, encryption, and tokenization, but obscurity-based or reversible disguising of log-in data does not survive a breach the way a one-way digest does; a candidate in the thread asks 'Why not C?' and the answer is that obfuscation still leaves recoverable content in many implementations. D (segmentation) is the strongest distractor because SpikeyOG quotes a study guide describing segmentation as isolating components to 'limit the impact of a breach.' That is a real benefit, but segmentation limits lateral movement and blast radius; it does nothing to make the credential records in the compromised log-in database unreadable, and the question asks specifically about that database.

Community Comment Notes

The learner vote overwhelmingly favors hashing (B: 68 vs D: 21), and commenters anchor on the keyword in the stem — one notes that the 'log-in database is the key in the question, which is related to hashing.' drosas84 is blunt that anyone choosing otherwise should 'hit the books,' pointing at the login step as the trigger word. The dissenting minority, led by SpikeyOG, treats the phrase 'limit the impact of a breach' as a segmentation cue lifted from study material, which is the defensible-sounding trap. A smaller faction, including mr.sgtan and a4e15bd, argues for tokenization, but their own reasoning concedes that the original data is preserved securely elsewhere — useful for payment data, wrong for passwords.

Exam Strategy

When a SY0-701 scenario names a specific database or data type, answer for that asset and its protection method, not for the general containment benefit. 'Limit the impact of a breach' is a phrase segmentation questions use for network diagrams; a log-in or credentials database signals hashing. If both appear, choose the control that makes the named data unreadable or unusable after theft.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the asset first: the stem specifies a log-in database, so the control must protect stored credentials rather than network paths. 'Limit the impact of a breach' is deliberately borrowed from segmentation descriptions, so weigh which option makes the named data useless if stolen. Almost always, credentials = hashing.

Frequently Asked Questions

Why is segmentation not the best fit for a log-in database breach?

Segmentation contains lateral movement and shrinks blast radius, but it does not make stolen credential records unreadable. Only one-way hashing removes the value of the data after a breach.

Why is tokenization wrong for a log-in database?

Tokenization suits data that must stay retrievable, like card numbers, using a stored vault mapping. Authentication requires comparing a verifier, which hashing provides and tokenization does not.

More SY0-701 FAQ →

Community Votes

B
76%
D
24%

76% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 20 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 20

  1. dbrowndiver 👍 7 Answered B
    When passwords are hashed, the database stores only the hash values instead of the actual passwords. This means that even if the database is breached, the attackers cannot easily obtain the original passwords. Hashing is a one-way function, meaning it is computationally infeasible to reverse-engineer the original input from the hash. This ensures that password data is secure even if exposed. Hashing significantly mitigates the risk of credential theft by ensuring that password data remains protected, making it the most effective choice for securing a log-in database against potential breaches. Hashing is the correct answer because it effectively limits the impact of a database breach by storing only hashed versions of passwords, thereby protecting sensitive credential information. Hashing ensures that even if the log-in database is compromised, the passwords remain secure and difficult for attackers to reverse-engineer.
  2. 35f7aac 👍 6
    Why not C? What if they do get the data? Data obfuscation is the process of disguising confidential or sensitive data to protect it from unauthorized access. Data obfuscation tactics can include masking, encryption, tokenization, and data reduction. Data obfuscation is commonly used to protect sensitive data such as payment information, customer data, and health records.
  3. SpikeyOG 👍 4 Answered D
    The correct answer is segmentation. From the CompTIA study guide, Segmentation is a method of securing data by dividing networks, data, and applications into isolated components to improve sensitive data protection, limit the impact of a breach, and improve network security
  4. a4e15bd 👍 3
    A. Tokenization Here is why: Tokenization replaces sensitive information with token that has no meaningful value outside the tokenization system. The original data is stored securely elsewhere. If the a database with tokenized data is breached, the sensitive information remains protected. Keep in mind, hashing only protects stored passwords which is by converting them into a fixed size string of characters that are irreversible, but what about all the other data that is also stored in a login database like username or emails, security questions and answers, multi factor authentication, account status or last login information. Hashing is not going to protect all that. This is why although hashing is a great choice for securing passwords, it is not the best option considering the context of a login database and hence tokenization is the correct answer!
  5. aed0e20 👍 3
    D. Segmentation Segmentation involves dividing a network into smaller, isolated segments to limit the potential impact of a breach. By segmenting the network, the organization can contain the breach within a specific segment, preventing it from spreading to other parts of the network, including the log-in database. This approach helps to minimize the scope of the breach and reduce the likelihood of unauthorized access to sensitive data.
Show 15 more comments
  1. Etc_Shadow28000 👍 3 Answered B
    B. Hashing Hashing is the most likely recommendation for protecting a log-in database. By hashing passwords, the organization ensures that even if the database is breached, the actual passwords are not exposed in plaintext. Hashing converts passwords into a fixed-size string of characters, which is not reversible, thus protecting user credentials. Therefore, the correct answer is: B. Hashing
  2. drosas84 👍 3 Answered B
    If you said anything besides B, you need to go back and hit the books. Keyword in the question is "log-in". What do you use to login? ID and password right? So hashing your ID and password will turn them into a string of nondescript text that cannot be reversed or decoded. Hashing log-in passwords will limit potential impact.
  3. nyyankee718 👍 3 Answered B
    log-in database is the key in the question, which is related to hashing
  4. Ty13 👍 2 Answered B
    B. Hashing Use Tokenization for payments and credit cards - the data needs to be retrievable, so you'd replace the sensitive info (your CC numbers) with a non-sensitive token to act as a dummy. If you use Apple/Android Pay, the CC you save on your phone is tokenized so the actual numbers can't be stolen. Hashing is for log-in databases and such where you need to secure the info.
  5. mr.sgtan 👍 2 Answered A
    For "log-in" database, using tokenization to replace sensitive data with non-sensitive placeholder can secure the log-in data information.
  6. Andrewyounan 👍 2 Answered B
    Just for clarification "log-in database" means username and password. Because it took me a minute to process it's not database-SQL
  7. braveheart22 👍 1 Answered D
    The correct answer is D. This is because, referencing the CompTIA study guide, Segmentation is a method of securing data by dividing networks, data, and applications into isolated components to improve sensitive data protection, limit the impact of a breach, and improve network security
  8. 9149f41 👍 1 Answered B
    When a network is breached, segmentation makes other parts of the network safer. However, gaining access to the database by breaking the log-in password will not be of any assistance. Instead, password hashing makes it more difficult for hackers to crack.
  9. RIDA_007 👍 1
    The answer is Hashing! The key is Log in and hashing is used for Authentication. During login, the system combines the entered password with the stored hashes. If the result matches the stored hash, the login is successful
  10. deejay2 👍 1 Answered D
    Segmentation. It deals with seperating the data, to store in different locations, to make it harder for the attacker during a breach.
  11. Xezita 👍 1
    A - It talks about limiting the potential impact.
  12. deejay2 👍 2
    D is the answer
  13. 17f9ef0 👍 2 Answered A
    Answer is A
  14. Shaman73 👍 2 Answered B
    B. Hashing
  15. jotanyik 👍 1
    A. Tokenization

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide