The correct answer is credential brute-force on a web login form. This Hydra command performs a targeted password spraying attack against a single web application login page, using the http-post-form module to send POST requests with the parameters username=^USER^ and password=^PASS^, while the string "Invalid login" tells Hydra which server response indicates a failed attempt. On the CompTIA PenTest+ PT0-002 exam, this tests your ability to interpret automated credential attacks against web services, a common objective in the attacks and exploits domain. A frequent trap is confusing this with a dictionary attack against SSH or FTP, but the http-post-form module explicitly targets web form authentication over HTTP. Remember the mnemonic "POST-PASS" to recall that Hydra's http-post-form requires three key components: the form path, the POST body with ^USER^ and ^PASS^ placeholders, and the failure string that distinguishes valid from invalid logins.
PT0-002 Tools and Code Analysis Practice Question
This PT0-002 practice question tests your understanding of tools and code analysis. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: hydra is a parallelized login cracker that supports numerous protocols.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is reviewing a Bash script that contains the following line: 'hydra -l admin -P /usr/share/wordlists/rockyou.txt $TARGET http-post-form "/login:username=^USER^&password=^PASS^:Invalid login"'. What is the primary purpose of this command?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Credential brute-force on a web login form
Option C is correct because the Hydra command targets a specific web login form (http-post-form) with a single username (-l admin) and a large password list (rockyou.txt), performing a credential brute-force attack. The syntax defines the POST parameters (username=^USER^&password=^PASS^) and the failure indicator ('Invalid login'), which Hydra uses to iterate through passwords until a successful login is found.
Key principle: Hydra is a parallelized login cracker that supports numerous protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Directory brute-forcing
Why it's wrong here
Directory brute-forcing uses tools like dirb or gobuster, not Hydra with a login form module.
✗
Password spraying
Why it's wrong here
Password spraying uses a few common passwords against many usernames; this command uses a single username and many passwords.
✓
Credential brute-force on a web login form
Why this is correct
Hydra's http-post-form module performs brute-force attacks on web forms, substituting username and password fields.
Clue confirmation
The clue word "primary" in the question point toward this answer.
Related concept
Hydra is a parallelized login cracker that supports numerous protocols.
✗
SQL injection
Why it's wrong here
SQL injection would involve malformed input to alter database queries, not repeated login attempts with a wordlist.
Common exam traps
Common exam trap: answer the scenario, not the keyword
CompTIA often tests the distinction between brute-force (single user, many passwords) and password spraying (many users, single password), and candidates confuse the two because both involve credential guessing.
Trap categories for this question
Command / output trap
Password spraying uses a few common passwords against many usernames; this command uses a single username and many passwords.
Detailed technical explanation
How to think about this question
Hydra's http-post-form module sends HTTP POST requests with the specified parameters, replacing ^USER^ and ^PASS^ with each candidate pair. The failure condition 'Invalid login' is matched against the response body; if absent, Hydra assumes success. This attack is rate-limited by default (e.g., 16 parallel tasks) and can be tuned with -t to avoid account lockouts or detection.
KKey Concepts to Remember
Hydra is a parallelized login cracker that supports numerous protocols.
The `http-post-form` module is used for brute-forcing web login forms.
`-l` specifies a single username, while `-P` specifies a password wordlist.
`^USER^` and `^PASS^` are placeholders for username and password in Hydra's web form modules.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Hydra is a parallelized login cracker that supports numerous protocols.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Review hydra is a parallelized login cracker that supports numerous protocols., then practise related PT0-002 questions on the same topic to reinforce the concept.
Tools and Code Analysis — This question tests Tools and Code Analysis — Hydra is a parallelized login cracker that supports numerous protocols..
What is the correct answer to this question?
The correct answer is: Credential brute-force on a web login form — Option C is correct because the Hydra command targets a specific web login form (http-post-form) with a single username (-l admin) and a large password list (rockyou.txt), performing a credential brute-force attack. The syntax defines the POST parameters (username=^USER^&password=^PASS^) and the failure indicator ('Invalid login'), which Hydra uses to iterate through passwords until a successful login is found.
What should I do if I get this PT0-002 question wrong?
Review hydra is a parallelized login cracker that supports numerous protocols., then practise related PT0-002 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "primary". Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
What is the key concept behind this question?
Hydra is a parallelized login cracker that supports numerous protocols.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.