A student in the authorized lab can read the target's password hashes but has not changed them or stopped the system. Which impact is demonstrated most directly?

### Why this is right The described outcome is unauthorized access to sensitive account data. Exposure is a confidentiality impact, whether or not the data is later altered or used to affect access. ### The concept A password hash is a stored representation used in password verification. It is not the plaintext password, but it is still sensitive information because someone may attempt to guess passwords against it. The lesson demonstrates copying hashes from a lab system and testing them offline to show the risk of exposing authentication data. This does not mean that every hash reveals its password immediately. The impact asked about is the initial exposure, so confidentiality is the most direct classification. Integrity would apply if the hashes or other stored data were changed. Availability would apply if authorized users were prevented from using the system. Keep the distinction between the information exposed and any later consequences. ### The other options - **B. Integrity, because the hashes have necessarily been changed**: Reading does not necessarily change data. Integrity would apply if a stored value were modified. - **C. Availability, because the system has been shut down**: The scenario says the system remains running. Shutdown is the lesson's availability example. - **D. No security impact, because hashes are not readable information**: Hashes are stored data and can be exposed. Their transformed form does not make access irrelevant. ### Terms - **Password hash**: A transformed representation of a password stored for checking password attempts. - **Confidentiality**: Protection of information from unauthorized access or disclosure. - **Integrity**: Protection of data from unauthorized modification. - **Availability**: Access to resources for authorized users when needed. - **Plaintext**: Information in its ordinary readable form, before a transformation such as encryption. ### Remember Accessing a sensitive hash file is an exposure, even when the underlying password is not shown directly.