Password Attacks GPEN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a pass-the-hash attack, what does the attacker use to authenticate?

   • AA captured password hash
   • BA Kerberos ticket
   • CA stolen session cookie
   • DThe plaintext password
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has experienced several account lockouts due to password spraying attempts. The security team wants to reduce the risk of successful password spraying while minimizing user frustration. Which control is most effective?

   • AIncreasing the account lockout threshold to 20 attempts
   • BDisabling account lockout to avoid user frustration
   • CRequiring passwords to be at least 8 characters long
   • DImplementing multi-factor authentication (MFA) for all user accounts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A tester is using Hashcat to crack a set of NTLM hashes. The tester wants to try all possible 6-character passwords consisting of digits and lowercase letters. Which Hashcat attack mode should be used?

   • ARule-based attack mode with a wordlist and rules.
   • BDictionary attack mode with a wordlist.
   • CBrute-force attack mode with a custom character set and length 6.
   • DHybrid attack mode combining words and digits.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration tester is assessing a company that enforces a strict account lockout policy: five failed attempts lock an account for 30 minutes. The tester has harvested a list of 2,000 valid usernames from the company's public directory. Which approach is most likely to successfully validate a few weak passwords without triggering a widespread lockout?

   • APerform a dictionary attack against each account with the top 10,000 words from a standard wordlist
   • BUse a wordlist of common passwords and try one password against all 2,000 usernames before moving to the next password
   • CRun a brute-force attack against one high-privilege account using all possible 8-character combinations
   • DUse a rule-based attack to generate 100 variations of each username and try them against the corresponding account
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A tester is performing an offline crack of a set of MD5 hashes. The tester has a wordlist of common passwords and suspects users have appended a two-digit year to their passwords, such as 'summer24'. Which attack mode should the tester use to efficiently test these variations?

   • ABrute-force mode with a mask of ?l?l?l?l?l?l?d?d
   • BHybrid mode that appends a two-digit mask to each word
   • CCombinator mode that concatenates two words
   • DStraight mode with the wordlist as-is
   Reveal Solution Discussion Select an answer first