Password Attacks GPEN Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A tester needs to crack a password hash that is known to be exactly 4 characters long, using only lowercase letters. The tester has no wordlist. Which attack mode is most suitable?

   • ABrute-force attack with a character set of a-z and length 4.
   • BHybrid attack appending digits to dictionary words.
   • CRainbow table attack using a precomputed table.
   • DDictionary attack using a standard wordlist.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A penetration tester wants to avoid locking out user accounts while attempting to guess passwords. Which technique is most appropriate?

   • APassword spraying
   • BBrute-force attack on a single account
   • CPass-the-hash attack
   • DRainbow table attack
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst discovers that many employees use the same email address and password on both the corporate VPN and a popular third-party shopping site. The shopping site recently suffered a data breach. Which attack is the analyst most concerned about?

   • APass-the-hash, where captured hashes are used to authenticate without plaintext
   • BCredential stuffing, where breached username/password pairs are replayed against the VPN
   • CPassword spraying, where a few common passwords are tried against all VPN accounts
   • DBrute-force, where all possible passwords are tried for each VPN account
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is experiencing a high volume of failed login attempts across its VPN and email systems. The security team suspects both password spraying and credential stuffing. They want to implement controls that reduce the risk of both attacks while minimizing impact on legitimate users. Which combination of controls is most effective?

   • AUse a deny list of common passwords and enforce a minimum password age
   • BEnforce MFA and implement a real-time threat intelligence feed to block known malicious IPs
   • CImplement account lockout after 3 attempts and require password changes every 30 days
   • DIncrease the password length requirement to 15 characters and disable account lockout
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team discovers that several employees use the same password on a corporate portal and on a third-party shopping site that was breached. The team suspects attackers are logging in with the breached credentials. Which attack are the attackers most likely performing?

   • ACredential stuffing using username/password pairs from the breach.
   • BBrute-force attack trying all possible character combinations.
   • CRainbow table attack using precomputed hash tables.
   • DPassword spraying with a few common passwords against all users.
   Reveal Solution Discussion Select an answer first