ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Rainbow table attacks rely on matching pre-computed hashes to stolen hash values. The most effective countermeasure is to combine each plaintext password with a long, cryptographically strong random salt that is unique per user, then hash the result with a secure algorithm such as SHA-512 (or a dedicated password-hash function). A unique salt forces an attacker to regenerate tables for every account individually, making large-scale offline cracking impractical. Using the same salt for every password still allows a single rainbow table to work for all records. Encrypting the column with a KMS-managed key protects data at rest but offers no protection once an attacker gains access to the ciphertext and key or performs offline hash analysis. AWS Secrets Manager is intended for application secrets like API keys; it is not a scalable store for individual end-user passwords and would still require proper hashing and salting.