Password Cracking Countermeasures EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web application is experiencing a distributed brute-force attack where attackers rotate IP addresses to avoid lockout. Which countermeasure is most effective in this scenario?

   • AImplement device fingerprinting and require additional verification when the device is unrecognized.
   • BIncrease the account lockout threshold to 100 attempts.
   • CBlock all traffic from the top 10 offending countries.
   • DDisable account lockout and rely on CAPTCHA after 3 failures.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's help desk is overwhelmed by password reset requests because users forget their complex passwords. The security team wants to reduce password-related support tickets while still maintaining strong resistance to password cracking. Which combination of measures best achieves this goal?

   • AEnforce a 12-character minimum with passphrase guidance and enable MFA for all accounts.
   • BImplement a password manager for all users and disable MFA because the manager generates strong passwords.
   • CKeep the current 8-character complexity requirement but require a password change every 30 days.
   • DRemove password complexity rules and rely solely on account lockout after 3 failed attempts.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial institution wants to protect its customer portal from online brute-force attacks. They have a strict requirement that legitimate customers must never be locked out, but they also need to stop attackers who use botnets with rotating IP addresses. Which approach best satisfies both constraints?

   • ARequire MFA for all logins, but do not monitor for brute-force attempts.
   • BLock the account for 24 hours after 5 failed attempts.
   • CUse risk-based authentication that challenges suspicious logins with MFA or CAPTCHA, without permanent lockout.
   • DBlock IP addresses after 10 failed attempts.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's password policy requires 8 characters with at least one uppercase letter, one number, and one symbol. An auditor recommends strengthening the policy. Which change provides the greatest improvement in resistance to offline brute-force attacks?

   • ARequire a password change every 30 days.
   • BAdd a requirement for at least two symbols and two numbers.
   • CIncrease the minimum length to 14 characters while keeping complexity requirements.
   • DBlock passwords that appear in a list of common passwords.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization's web application has been hit by a brute-force attack on its admin login page. The security team wants to stop the attack without locking out legitimate users who mistype their password occasionally. Which control is most effective?

   • ADisable account lockout and rely on logging failed attempts for later review.
   • BIncrease the password minimum length to 20 characters and require special characters.
   • CImplement account lockout after 5 failed attempts for 15 minutes, and add rate limiting per IP address.
   • DLock accounts permanently after the first failed attempt and require a help desk call to unlock.
   Reveal Solution Discussion Select an answer first