Password Attacks GPEN Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   In which environment is a pass-the-ticket attack most relevant?

   • AA Linux environment using SSH keys
   • BA web application using OAuth tokens
   • CA cloud service using API keys
   • DA Windows domain using Kerberos authentication
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What is a major limitation of rainbow table attacks?

   • AThey are slower than brute-force attacks.
   • BThey only work on Windows systems.
   • CThey require a live connection to the target system.
   • DThey are ineffective against salted hashes.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A penetration tester is assessing a web application that uses a poorly-designed login API. The API returns a generic 'invalid credentials' error for both wrong username and wrong password, but it also returns a different HTTP status code when the account is locked. The tester has a list of 500 usernames and wants to identify valid usernames without causing a full account lockout. The lockout policy is 10 failed attempts per 15 minutes. Which approach is most effective?

   • APerform a brute-force attack against each username with a small wordlist of 100 passwords
   • BUse a dictionary attack with a large wordlist against one username at a time
   • CUse a credential stuffing attack with breached username/password pairs
   • DPerform a password spraying attack with 3 common passwords against all 500 usernames
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A penetration tester is assessing a company that enforces a 5-attempt account lockout policy. The tester has a list of 2,000 usernames and wants to test password strength without triggering a widespread lockout. Which approach best fits the constraint?

   • ARun a full dictionary list of 10,000 passwords against each account sequentially.
   • BTry the top 3 passwords from a breach corpus against all 2,000 accounts, waiting 10 minutes between attempts per account.
   • CPerform a brute-force attack on one account with all possible 8-character combinations.
   • DUse a rule-based attack to generate 100 variations per password and test them against all accounts.
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A tester is using John the Ripper to crack hashes. The tester has a wordlist and wants to generate variations like 'Password1!', 'p@ssw0rd', and 'Admin2024'. Which configuration is most appropriate?

   • AUse a brute-force mode with a mask for 8 characters.
   • BUse a rule-based mode with a custom ruleset that includes capitalization, leet substitution, and appending digits/symbols.
   • CUse a dictionary mode with the wordlist as-is.
   • DUse a hybrid mode that appends digits only.
   Reveal Solution Discussion Select an answer first