Password Attacks GPEN Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A tester has a large set of SHA-1 hashes from a legacy system. The hashes are unsalted. The tester has limited disk space but a very fast GPU. The tester needs to recover as many plaintext passwords as possible within a day. Which approach is most appropriate?

   • AUse a hybrid attack that combines a wordlist with a mask for digits
   • BRun a dictionary attack with a large wordlist and common rules
   • CRun a brute-force attack with a mask of all printable characters up to length 7
   • DUse a rainbow table set that covers the likely password keyspace
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is a rainbow table used for in password cracking?

   • ATo bypass authentication by replaying captured hashes.
   • BTo generate random passwords for brute-force attacks.
   • CTo store plaintext passwords for comparison.
   • DTo reverse hashes by looking up precomputed hash-to-plaintext mappings.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which characteristic is most typical of an online password attack?

   • AIt requires physical access to the target server.
   • BIt can be performed without any interaction with the target system.
   • CIt is always faster than an offline attack.
   • DIt involves sending guesses to a live authentication service.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company has suffered a breach where 10,000 username/password pairs were leaked. The company uses the same credentials for a cloud portal. The security team wants to block attackers using these leaked credentials. Which control is most effective?

   • ADisable MFA to simplify the login process.
   • BIncrease the account lockout threshold to 10 attempts.
   • CEnforce a password history policy that prevents reuse of old passwords.
   • DImplement a credential-stuffing detection system that flags logins using known breached passwords.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which attack method systematically tries every possible combination of characters up to a certain length?

   • ARainbow table attack
   • BPassword spraying
   • CBrute-force attack
   • DDictionary attack
   Reveal Solution Discussion Select an answer first