Password Cracking and Attacks CEH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a known vulnerability of using unsalted MD5 for password storage?

   • AIt makes the password longer than the original input
   • BIt prevents the use of dictionary attacks
   • CIt allows attackers to use precomputed tables to quickly reverse common passwords
   • DIt stores passwords in plaintext on the server
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is performing an assessment of a web application. The tester wants to test the login form for weak passwords without triggering account lockouts. Which technique is most appropriate?

   • AUse a password spraying attack with a few common passwords against many accounts
   • BUse a brute-force attack with all possible character combinations
   • CUse a dictionary attack with a large wordlist against a single account
   • DUse a rule-based attack on a single account
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester has captured a set of NTLM hashes from a Windows domain. The tester knows the organization enforces a password policy that requires at least 8 characters, but many users still choose common words with predictable substitutions (e.g., 'Password1'). The tester wants to maximize the number of cracked hashes in the shortest time. Which approach is most effective?

   • AUse a rule-based attack with a wordlist and common substitution rules
   • BRun a pure brute-force attack against all 8-character combinations
   • CUse a dictionary attack with a wordlist of common passwords
   • DPerform an online password spraying attack against the domain
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is password security considered a critical aspect of system hacking defense?

   • ABecause weak passwords are often the only barrier between an attacker and sensitive data
   • BBecause password security eliminates the need for other security measures like firewalls
   • CBecause passwords are stored in plaintext on all systems by default
   • DBecause passwords are the only method of authentication used in modern systems
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a feature of John the Ripper?

   • AIt is primarily used for network traffic analysis
   • BIt is a commercial tool that requires a paid license
   • CIt only works on Windows operating systems
   • DIt supports multiple hash algorithms and can be configured with custom rules
   Reveal Solution Discussion Select an answer first