Exam PT0-002 topic 1 question 340 discussion

The penetration tester recommended the code be updated to use a random salt instead of a fixed salt for hashing passwords.Therefore, the penetration tester should recommend changing passwords that were created before this code update, so that they can be hashed with the new salt and be more secure. The other options are not valid steps that the penetration tester should recommend. Keeping hashes created by both methods for compatibility would defeat the purpose of updating the code, as it would leave some hashes vulnerable to attacks. Rehashing all old passwords with the new code would not work, as it would require knowing the plaintext passwords, which are not stored in the database. Replacing the SHA-256 algorithm to something more secure is not necessary, as SHA-256 is a secure and widely used hashing algorithm that has no known vulnerabilities or collisions.

Without the original plaintext passwords, it's impossible to rehash old passwords. You cannot reverse a hash to get the plaintext password, so users will need to reset their passwords.

A C is wrong: Without knowing the original plaintext password, rehashing old passwords is impossible.