Password Cracking Techniques EHE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the context of a security assessment, why would an ethical hacker crack password hashes that were obtained from a target system?

   • ATo demonstrate the impact of weak password policies by showing that some hashes can be reversed quickly.
   • BTo verify that the hashes were generated using a secure algorithm such as MD5.
   • CTo encrypt the hashes so that they are unreadable to other attackers.
   • DTo permanently disable user accounts by changing their passwords to unknown values.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is reviewing a set of captured password hashes from an older system that used unsalted LM hashes. The analyst wants to recover the passwords as quickly as possible using a tool that can leverage precomputed hash chains. Which tool and technique combination is most appropriate?

   • AUse Ophcrack with its included rainbow tables
   • BUse Hashcat with a brute-force mask attack
   • CUse John the Ripper with a wordlist and rules
   • DUse a custom script to try every possible password online
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of applying rules in a rule-based password attack?

   • ATo limit the attack to only the exact words in the dictionary.
   • BTo transform dictionary words into variations that users commonly create.
   • CTo sort the dictionary words by probability of being used.
   • DTo encrypt the dictionary words before hashing them.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is assessing the password security of a small business. The tester has access to the hashed password database but does not know the hashing algorithm. The tester wants to first try the most efficient technique to crack as many passwords as possible. Which technique should the tester start with?

   • AHybrid attack that appends numbers to dictionary words.
   • BDictionary attack using a comprehensive wordlist of common passwords.
   • CRainbow table attack using a precomputed table for the unknown algorithm.
   • DBrute force attack starting with 1-character passwords and increasing length.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester has obtained a list of hashed passwords from a client's Linux system. The client's password policy requires at least one uppercase letter and one digit, but users often base their passwords on common words. Which Hashcat approach would most efficiently test the most likely password variations?

   • APerform a brute-force attack over all 8-character combinations
   • BRun a straight dictionary attack with the rockyou.txt wordlist
   • CUse a rainbow table attack with precomputed hashes
   • DUse a rule-based attack with rules that capitalize the first letter and append digits
   Reveal Solution Discussion Select an answer first