ITPEC FE Subject B October 2024 Question 18

Topic: Security Scenarios

From the answer group below, select the correct answer to be inserted into blank in the description.

Company B runs several web services. Mr. Y is a software engineer in the company. He was directed to develop a feature that prevents web service users from setting weak passwords. Mr. Y investigated and found that “Password Entropy” is the important factor for the password strength.

Password entropy measures the strength of a password based on the difficulty of cracking the password through guessing or a brute-force attack. The entropy of a password is typically based on the type of characters used—lowercase letters, uppercase letters, numerical digits, or special characters—and the length of the password or total number of characters.

Password entropy formula:
You can measure the entropy of a password in bits using the following formula:

E = ⌊L ×Log2 (R)⌋

In this formula:

-E denotes the password entropy-R denotes the possible range of character types in the password-L denotes the number of characters in the password (its length)-Log2 answers the question, "to what power 2 must be raised to equal this number"-⌊X⌋ denotes the greatest integer N such that N ≤ X

The following totals show the breakdown for each character set as they appear on a typical American QWERTY keyboard:
Lowercase letters (a–z) = 26.
Uppercase letters (A–Z) = 26.
Numerical digits (0–9) = 10.
Special characters (!, @, #, $, %, ^, etc.) = 32.

The password vfssxfrb has a pool of 26 characters (lowercase letters);
Changing the password to JAAdMAdE would increase the pool to 52 characters (lowercase letters and uppercase letters);
Changing it further to u7aHqsbt would increase the pool to 62 characters (lowercase letters, uppercase letters along with numbers) and
Finally, Re*ct7$% has a pool of 26 + 26 + 10 + 32 = 94 characters (lowercase letters, uppercase letters, numbers, and special characters).

In our example:

  • •For vfssxfrb, we have R = 26 and L = 8; thus,
    E = ⌊8 × log2(26) ⌋ ≈ ⌊8 × 4.700⌋ ≈ ⌊37.60⌋ = 37 bits
  • •For JAAdMAdE, we have R = 52 and L = 8; thus,
    E = ⌊8 × log2(52) ⌋ ≈ ⌊8 × 5.700⌋ ≈ ⌊45.60⌋ = 45 bits
  • •For u7aHqsbt, we have R = 62 and L = 8; thus,
    E = ⌊8 × log2(62) ⌋ ≈ ⌊8 × 5.954⌋ ≈ ⌊47.63⌋ = 47 bits
  • •For Re*ct7$%, we have R = 94 and L = 8; thus,
    E = ⌊8 × log2(94) ⌋ ≈ ⌊8 × 6.555⌋ ≈ ⌊52.44⌋ = 52 bits

Here, when the password is A6GmyVyOC (Using numerical digits, lowercase letters, and uppercase letters. L = 9), the password entropy is blank bits.

Answer group

Explanation

53 bits — the password mixes uppercase letters, lowercase letters and digits, so R = 62, with L = 9.

  • •Characters in A6GmyVyOC: uppercase (A, G, V, O, C), lowercase (m, y, y) and one digit (6); no special characters
  • •Pool: R = 26 + 26 + 10 = 62
  • •log₂ 62 ≈ 5.954, as in the u7aHqsbt example
  • •9 × 5.954 ≈ 53.59, and the floor is 53

Answer (d)

Why not others:

  • •(a) 42 — R = 26, lowercase only: 9 × 4.700 = 42.30
  • •(b) 51 — R = 52, forgetting the digit: 9 × 5.700 = 51.30
  • •(c) 52 — the result of the last worked example, Re*ct7$% with L = 8 and R = 94, not this password
  • •(e) 58 — R = 94, counting special characters that are not there: 9 × 6.555 = 58.99

Key rule: R is the combined size of every character set the password draws from, not the number of distinct characters it contains; take the floor only after multiplying by L.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.