An attacker has a list of usernames and a small set of common passwords. The attacker wants to avoid account lockouts while testing many accounts. Which technique is most appropriate?

Password spraying with one password per user across many accounts

Rainbow table attack on the login form

Dictionary attack using a large wordlist on one account

Brute-force attack against a single account

In the context of system hacking, what is the primary purpose of password cracking?

To create new user accounts on a target system

To recover plaintext passwords from stored hashes or through authentication attempts

To verify that passwords meet organizational complexity requirements

To encrypt passwords so they cannot be read by unauthorized users

A security analyst is investigating a possible brute-force attack on the company's VPN portal. The analyst notices that the VPN logs show thousands of failed login attempts from a single IP address over the past hour, but no successful logins. The analyst wants to stop the attack immediately while minimizing disruption to legitimate users. Which action should the analyst take first?

Block the attacking IP address at the firewall

Disable the VPN service for all users

Increase the VPN password complexity requirement

Reset the passwords of all VPN users

What is the primary purpose of adding a salt to a password before hashing?

To make the hash faster to compute for verification

To encrypt the password so it can be decrypted later

To compress the hash so it takes up less storage space

To ensure that identical passwords produce different hash values

EC-CouncilCertified Ethical Hacker

Domain 3Objective 2

Password Cracking and Attacks CEH Practice Questions (Page 2)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 6–10

6application · medium
An attacker has a list of usernames and a small set of common passwords. The attacker wants to avoid account lockouts while testing many accounts. Which technique is most appropriate?
Select an answer first
7foundation · easy
Which tool is known for its ability to perform extremely fast GPU-accelerated password cracking?
Select an answer first
8foundation · easy
In the context of system hacking, what is the primary purpose of password cracking?
Select an answer first
9application · medium
A security analyst is investigating a possible brute-force attack on the company's VPN portal. The analyst notices that the VPN logs show thousands of failed login attempts from a single IP address over the past hour, but no successful logins. The analyst wants to stop the attack immediately while minimizing disruption to legitimate users. Which action should the analyst take first?
Select an answer first
10foundation · easy
What is the primary purpose of adding a salt to a password before hashing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Password Cracking and Attacks CEH Practice Questions (Page 2)

Questions 6–10

An attacker has a list of usernames and a small set of common passwords. The attacker wants to avoid account lockouts while testing many accounts. Which technique is most appropriate?

Which tool is known for its ability to perform extremely fast GPU-accelerated password cracking?

In the context of system hacking, what is the primary purpose of password cracking?

What is the primary purpose of adding a salt to a password before hashing?

Keep studying — System Hacking Phases and Attack Techniques