Quiz — Hashing
10-question quiz on hash properties, algorithms, and password storage
Hashing — Module Quiz
Ten APPLY items on one-way digests (deterministic, avalanche, fixed length), why hashing is not encryption, MD5 and SHA-1 collision history at defender level, SHA-256 as the file-integrity default, openssl dgst on a file you own, unique salts and slow KDFs (bcrypt, Argon2, scrypt) versus fast SHA-256, pepper as a concept, never MD5(password), and the lookup lab: a toy YOU hashed, an 8-word list YOU wrote, unsalted SHA-256 of password findable in that list — never hashcat, never /etc/shadow, never HaveIBeenPwned dumps, never other people’s hashes, never rainbow-table downloads. Notes live in $HOME/cyberlium-lab with chmod 600. Wrong answers still teach. A matching vendor checksum is still not a malware scan. A slow KDF is still not a license to attack a stolen table. Carry Topic 7’s integrity habit: hashlib fingerprints bytes you are allowed to touch, matching hex is byte equality not a malware certificate, hashing is not a lockbox. Password storage is a different family — unique salt, library verify, no homemade SHA-256 loops. Next after this quiz is Symmetric Encryption (AES): one shared key locks and unlocks, still not a hash, still authorized labs only, still chmod 600 on notes that might later mention keys you generated for yourself.
APPLY: A teammate calls the SHA-256 of an ISO “encryption so thieves cannot steal it,” then wants to reverse /etc/shadow for practice. What is a cryptographic hash, and what do you do?
APPLY: True or False: Hashing equals encryption, so matching a vendor SHA-256 means the file is confidential and you should download rainbow tables to “decrypt” lab hexes.
APPLY: You hashed hash-algorithms-demo.txt with hashlib and openssl dgst. Which algorithm is preferred for new file-integrity hashing, and what must you not point dgst at?
APPLY: Why is MD5 discouraged for signatures, certificates, and untrusted-download integrity, and what is not this course’s homework?
APPLY: Select good password-storage practices for a leak-assumed database. (Select 2)
APPLY: Alice and Bob both use the toy “correct-horse.” What is a salt primarily, and what mistake still lets one guess hit everyone?
APPLY: True or False: Fast unsalted hashes of common passwords crack easily offline — therefore this module’s required homework is hashcat on a HaveIBeenPwned dump and /etc/shadow.
APPLY: You edited hash-functions-demo.txt by one line and the SHA-256 hex looked unrelated. What is avalanche, and what must you not do with that hex?
APPLY: Ethical hash-lookup labs in this module should use which inputs, and which files stay chmod 600?
APPLY: File download integrity and the next module — which pairing do you carry, and what opens after this quiz?