Password Attacks GPEN Practice Questions (Page 12)

Questions 56–57

1. 56foundation · easy

   What is the defining characteristic of a password spraying attack?

   • AIt reuses stolen credentials from other breaches.
   • BIt uses a large wordlist against a single account.
   • CIt tries a few common passwords against many accounts.
   • DIt uses precomputed hash tables.
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   A tester has captured a set of hashes from a Windows domain. The hashes are NTLM, and the tester knows the password policy requires at least 8 characters, including uppercase, lowercase, digits, and symbols. The tester has a GPU that can test 10 billion hashes per second for NTLM. The tester also has a large wordlist and a set of common rules. Which strategy is most likely to crack the most hashes within a 2-hour window?

   • ARun a rule-based attack with a small set of 10 rules
   • BRun a rainbow table attack using a precomputed NTLM table
   • CRun a hybrid attack with the wordlist and a mask for digits and symbols
   • DRun a brute-force attack with a mask of all printable characters up to length 8
   Reveal Solution Discussion Select an answer first