Attacking Passwords GCIH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which countermeasure is most effective at preventing credential stuffing attacks?

   • AUsing a longer password hash algorithm
   • BRequiring passwords to be at least 8 characters long
   • CDisabling account lockout policies
   • DMulti-factor authentication (MFA)
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An incident responder has captured a set of NTLM hashes from a compromised Windows server. The responder needs to recover the plaintext passwords to check for reuse across other systems. The responder has limited time and computing resources. Which approach is most efficient?

   • AUse a pass-the-hash attack to authenticate to other systems
   • BPerform an online password spraying attack against the server
   • CUse a pure brute force attack that tries every possible character combination
   • DUse a dictionary attack with a wordlist and rule-based mutations
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst notices a pattern of failed logins across the organization: over the past hour, each of 500 user accounts has experienced exactly three failed authentication attempts, each using a different common password (e.g., 'Winter2024!', 'Company123!', 'Password1!'). No single account has more than three failures, and the attempts originate from a single external IP address. Which type of attack is most consistent with this observation?

   • APass-the-hash attack
   • BBrute force attack
   • CPassword spraying
   • DCredential stuffing
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident responder has obtained a file containing password hashes from a compromised Linux server. The responder wants to determine the plaintext passwords without interacting with the live system. Which approach is most appropriate?

   • APerform a password spraying attack against the server's login page
   • BAttempt a brute force attack via SSH
   • CUse a pass-the-hash tool to authenticate to the server
   • DRun an offline cracking tool such as John the Ripper against the hash file
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key difference between online and offline password attacks?

   • AOnline attacks are always faster than offline attacks
   • BOnline attacks do not require any credentials
   • COffline attacks require physical access to the target system
   • DOnline attacks interact with live systems, while offline attacks work on captured data
   Reveal Solution Discussion Select an answer first