A security analyst is testing password strength for a corporate environment. The analyst notices that many users create passwords like 'Summer2024!' or 'Company#1'. Which attack technique would be most effective at cracking these passwords?

A pure brute-force attack over all 10-character combinations

A rainbow table attack with precomputed hashes

A hybrid attack that appends years and symbols to dictionary words

A plain dictionary attack with a standard wordlist

A security engineer is evaluating whether to use a brute-force attack or a dictionary attack for a penetration test. The target system uses salted hashes and the engineer has a limited time window. The engineer knows that users tend to choose passwords based on common words. Which approach is most likely to yield results within the time constraint?

Hybrid attack that only appends digits

Dictionary attack with a large wordlist and common rules

Rainbow table attack with precomputed tables

Brute-force attack over all 8-character combinations

What does a hybrid attack add to a dictionary word to generate password candidates?

The user's username or other personal information

Other dictionary words to form multi-word phrases

Randomly generated characters from the full ASCII set

Common variations such as numbers, symbols, or case changes

A security analyst is using John the Ripper to crack password hashes from a Linux system. The analyst has a wordlist but notices that many passwords are variations of common words, such as 'Password1' or 'Summer2023!'. Which John the Ripper feature would be most effective for generating these variations from the wordlist?

Use the '--incremental' mode to perform a brute force attack from scratch.

Use the '--rules' option to apply transformation rules that modify each word in the wordlist.

Use the '--wordlist' option with a larger wordlist that includes common variations.

Use the '--show' option to display already cracked passwords.

Which countermeasure would be most effective at preventing an attacker from using a cracked password to access an account?

Multi-factor authentication (MFA)

EC-CouncilEthical Hacking Essentials

Domain 2Objective 4

Password Cracking Techniques EHE Practice Questions (Page 3)

Part of the Malware and Password Attacks domain, which makes up ~14% of our current practice bank.

42questions here

9free pages

10concepts

Questions 11–15

11application · medium
A security analyst is testing password strength for a corporate environment. The analyst notices that many users create passwords like 'Summer2024!' or 'Company#1'. Which attack technique would be most effective at cracking these passwords?
Select an answer first
12expert · hard
A security engineer is evaluating whether to use a brute-force attack or a dictionary attack for a penetration test. The target system uses salted hashes and the engineer has a limited time window. The engineer knows that users tend to choose passwords based on common words. Which approach is most likely to yield results within the time constraint?
Select an answer first
13foundation · easy
What does a hybrid attack add to a dictionary word to generate password candidates?
Select an answer first
14application · medium
A security analyst is using John the Ripper to crack password hashes from a Linux system. The analyst has a wordlist but notices that many passwords are variations of common words, such as 'Password1' or 'Summer2023!'. Which John the Ripper feature would be most effective for generating these variations from the wordlist?
Select an answer first
15foundation · easy
Which countermeasure would be most effective at preventing an attacker from using a cracked password to access an account?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Password Cracking Techniques EHE Practice Questions (Page 3)

Questions 11–15

A security analyst is testing password strength for a corporate environment. The analyst notices that many users create passwords like 'Summer2024!' or 'Company#1'. Which attack technique would be most effective at cracking these passwords?

What does a hybrid attack add to a dictionary word to generate password candidates?

Which countermeasure would be most effective at preventing an attacker from using a cracked password to access an account?

Keep studying — Malware and Password Attacks