Password Cracking and Attacks CEH Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company wants to improve password security but faces user resistance to long passwords. The security team proposes a policy of 8-character complex passwords plus mandatory MFA. Which critique is most valid?

   • AComplex passwords are harder for users to remember, leading to reuse
   • BMFA is not effective against password cracking
   • C8-character complex passwords are still vulnerable to offline brute-force attacks
   • DThe policy should require a change every 30 days to be effective
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a recommended best practice for creating a strong password policy?

   • ARequire a minimum length of at least 12 characters
   • BRequire passwords to be changed every 30 days
   • CAllow users to reuse their previous 5 passwords
   • DDo not enforce any complexity requirements
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of implementing account lockout policies as part of password security?

   • ATo allow unlimited login attempts for convenience
   • BTo prevent online brute-force attacks by limiting the number of failed attempts
   • CTo make passwords easier to remember
   • DTo ensure that passwords are stored in plaintext
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security auditor is reviewing the password practices of a healthcare organization. The organization uses a single shared password for all staff to access a legacy medical device. The auditor wants to reduce the risk of unauthorized access while minimizing disruption to clinical workflows. Which recommendation is the most effective?

   • ADocument the shared password in a secure password manager
   • BImplement individual user accounts with unique passwords for each staff member
   • CChange the shared password to a strong, complex password and share it only with authorized staff
   • DRestrict network access to the medical device
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An attacker has a list of hashes and a wordlist of common passwords. The attacker wants to try variations like 'Password1', 'Password!', and 'P@ssword' without manually editing the wordlist. Which attack technique automates these transformations?

   • ARainbow table attack
   • BBrute-force attack
   • COnline password spraying
   • DRule-based attack
   Reveal Solution Discussion Select an answer first