CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Password spraying

  Why this is correct

  Password spraying is a targeted attack where an attacker attempts a small number of common passwords against a large list of usernames. This technique is specifically designed to bypass account lockout policies by distributing login attempts across many accounts, rather than repeatedly failing on a single account. By trying 'Password123!' on hundreds of accounts, the attacker significantly increases their chances of finding a valid credential without triggering security alerts for excessive failed logins on one user. This method is highly effective against organizations with weak password policies and large user bases.

• ✗

  Credential stuffing

  Why it's wrong here

  Credential stuffing involves using large sets of username and password pairs, typically obtained from data breaches of other websites, to attempt logins on a target web application. Attackers leverage the common user practice of reusing credentials across multiple services, hoping that a combination compromised elsewhere will grant access to the current system. This attack relies on pre-existing compromised data rather than guessing, making it distinct from brute-force methods. Automated tools are often employed to rapidly test thousands or millions of stolen credentials against the target.

• ✗

  Brute force attack

  Why it's wrong here

  A brute force attack systematically attempts every possible combination of characters for a password until the correct one is found for a single target account. This method is exhaustive and computationally intensive, often starting with simple combinations and progressively increasing complexity. Its primary limitation is the high probability of triggering account lockout policies or being detected by intrusion prevention systems due to numerous failed login attempts against a single user. While theoretically guaranteed to succeed given enough time, practical defenses often render it inefficient.

• ✗

  Dictionary attack

  Why it's wrong here

  A dictionary attack attempts to guess a password for a single user by systematically trying words and phrases from a predefined list, such as common words, names, or previously leaked passwords. This method is more efficient than a pure brute-force attack because it focuses on the most likely passwords first, leveraging human tendencies to choose simple or common words. Like brute-force attacks, it targets a single account and is highly susceptible to account lockout policies and rate-limiting mechanisms. Attackers often augment standard dictionaries with common variations and leetspeak.

Go deeper

Related to this question