What is the primary process of a credential stuffing attack?

Guessing passwords by trying all possible combinations

Exploiting a vulnerability to bypass authentication

Using stolen username/password pairs from one site to attempt login on other sites

Intercepting credentials as they are transmitted over the network

Which control is most effective at preventing brute-force attacks on a web application login form?

Using a stronger hashing algorithm for passwords

Account lockout after a set number of failed attempts

A penetration tester is assessing a web application that uses a JSON-based login endpoint. The tester has confirmed that the application does not implement account lockout, but it does throttle requests from a single IP address after 20 failed attempts. The tester needs to attempt passwords for a single known username without triggering the IP-based throttle. Which approach should the tester use?

Increase the time delay between attempts to 30 seconds so the throttle resets after each request.

Switch to a dictionary attack using the same IP but with a larger wordlist to increase the chance of success.

Run Hydra with the -U flag to enumerate valid usernames before attempting passwords.

Use a wordlist with a single password per IP address by rotating through a pool of proxy IPs.

CompTIAPenTest+

Domain 4Objective 2

Authentication Attacks PT0-003 Practice Questions (Page 2)

Part of the Attacks and exploits domain, which accounts for 35% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~23–39 in this domain), expect 4–7 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

9concepts

35%of the exam

Questions 6–10

6foundation · easy
What is the primary process of a credential stuffing attack?
Select an answer first
7application · medium
A penetration tester has captured NTLM hashes from a Windows domain and wants to use them to authenticate to a remote machine using SMB. Which tool is specifically designed to perform pass-the-hash attacks over SMB?
Select an answer first
8foundation · easy
Which control is most effective at preventing brute-force attacks on a web application login form?
Select an answer first
9application · medium
A penetration tester is assessing a web application that uses a JSON-based login endpoint. The tester has confirmed that the application does not implement account lockout, but it does throttle requests from a single IP address after 20 failed attempts. The tester needs to attempt passwords for a single known username without triggering the IP-based throttle. Which approach should the tester use?
Select an answer first
10foundation · easy
Which tool is commonly used to perform brute-force attacks against network services such as SSH and FTP?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Authentication Attacks PT0-003 Practice Questions (Page 2)

Questions 6–10

What is the primary process of a credential stuffing attack?

A penetration tester has captured NTLM hashes from a Windows domain and wants to use them to authenticate to a remote machine using SMB. Which tool is specifically designed to perform pass-the-hash attacks over SMB?

Which control is most effective at preventing brute-force attacks on a web application login form?

Which tool is commonly used to perform brute-force attacks against network services such as SSH and FTP?

Keep studying — Attacks and exploits