Authentication Attacks PT0-003 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which characteristic is most typical of a brute-force attack compared to other password guessing methods?

   • AIt uses a phishing page to capture credentials
   • BIt relies on a precompiled list of previously compromised passwords
   • CIt targets a specific user by using personal information to guess passwords
   • DIt attempts a large number of combinations in a systematic manner
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's VPN gateway is being targeted by brute-force attacks. The security team wants to implement a control that will block attackers after a set number of failed attempts but also allow legitimate users who mistype their password to retry without being permanently locked out. Which control best meets this requirement?

   • AIncrease the password complexity requirement to 20 characters.
   • BDisable the VPN service and require users to use a different remote access method.
   • CLog all failed attempts and review them monthly for suspicious patterns.
   • DImplement a temporary account lockout that expires after 30 minutes.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security administrator is hardening a Windows environment against pass-the-hash attacks. The organization uses NTLM for legacy applications and cannot disable it. The administrator wants to implement a control that will make it harder for attackers to extract hashes from memory while maintaining compatibility with legacy applications. Which control is most effective?

   • AEnable Credential Guard and configure it to protect the NTLM hashes.
   • BDisable the Local Security Authority Subsystem Service (LSASS) to prevent hash extraction.
   • CUse the same local administrator password on all machines to simplify management.
   • DIncrease the password length to 25 characters for all users.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why are credential stuffing attacks often successful?

   • AWeb applications have weak encryption
   • BAttackers have unlimited computing power
   • CMost websites do not use HTTPS
   • DUsers frequently reuse the same password across multiple online services
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which security measure is most effective at preventing pass-the-hash attacks?

   • AUsing multi-factor authentication
   • BDisabling the guest account
   • CUsing a firewall to block external access
   • DEnforcing complex password policies
   Reveal Solution Discussion Select an answer first