Password Cracking Countermeasures EHE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is an example of a second authentication factor in MFA?

   • AA password
   • BA one-time code sent to a mobile device
   • CA username
   • DA security question
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A small business runs a customer-facing web portal. They want to prevent online brute-force attacks without causing a denial of service to legitimate users who mistype their passwords. Which approach is most effective?

   • ADisable the login form and require users to authenticate via email link each time.
   • BLock the account permanently after 3 failed attempts regardless of the user.
   • CRely on a strong password policy alone, since complex passwords cannot be brute-forced online.
   • DImplement progressive delay and temporary IP-based lockout after repeated failures, with account lockout only after a high threshold.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company's customer-facing portal has been hit by a credential-stuffing attack. The security team wants to block the attack without locking out legitimate customers who may have forgotten their passwords. The portal currently has no lockout or rate limiting. Which approach is most effective?

   • ABlock IP addresses that generate more than 10 failed attempts per hour.
   • BLock accounts after 3 failed attempts and require customers to call support to unlock.
   • CImplement per-account rate limiting that allows a small number of failures before requiring CAPTCHA, and enable MFA for all accounts.
   • DDisable the login form for 24 hours to stop the attack.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the main reason to enforce regular password rotation in an organization?

   • ATo ensure that passwords are never reused across different systems
   • BTo limit the window of opportunity if a password is compromised without detection
   • CTo make passwords easier for users to remember
   • DTo eliminate the need for multi-factor authentication
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company discovers that many employees use the same password for their corporate account and personal social media. The security team wants to reduce the impact of credential breaches from third-party sites. Which measure is most directly effective?

   • AIncrease password complexity requirements to 15 characters with all character types.
   • BEnable account lockout after 3 failed attempts.
   • CDeploy a company-approved password manager and require unique passwords for corporate accounts.
   • DShorten the password rotation interval to 30 days.
   Reveal Solution Discussion Select an answer first