CEH Enumeration and System Hacking Practice Question

A security administrator notices repeated failed login attempts from a single IP address targeting the SSH service. The attempts use common usernames (root, admin, test) and a list of passwords from a dictionary. What type of password attack is being conducted?

⚠ Common exam trap

Test-takers frequently confuse a dictionary attack with a brute-force attack; CEH emphasizes that a dictionary attack uses a wordlist of likely passwords, while a brute-force attack exhaustively tries all possible character combinations, regardless of likelihood.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Dictionary attack

This is a dictionary attack because the attacker uses a predefined list of common usernames and passwords (a dictionary) against the SSH service. Unlike a brute-force attack that tries all possible combinations, a dictionary attack only tests likely entries from a wordlist, making it faster but limited to the dictionary's contents.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Rainbow table attack
Why it's wrong here
A rainbow table attack is an offline technique used to reverse cryptographic hash functions by precomputing a massive table of hash-to-plaintext pairs. This method is ineffective against online login attempts because attackers do not have direct access to the stored password hashes and are instead interacting with a login interface subject to rate limiting and account lockout policies. Therefore, it cannot be used to directly guess passwords in real-time against a live system.
✓
Dictionary attack
Why this is correct
A dictionary attack involves systematically attempting to log in using a predefined list of common words, phrases, or previously leaked passwords against a target username or set of usernames. This method leverages the widespread use of weak, easily guessable passwords by users, making it a highly efficient strategy for gaining unauthorized access. It is particularly effective when systems lack robust password policies or account lockout mechanisms to deter repeated login failures.
✗
Hybrid attack
Why it's wrong here
A hybrid attack combines elements of a dictionary attack with systematic modifications, such as appending or prepending numbers, symbols, or applying common character substitutions (e.g., 'a' to '@', 's' to '$'). This approach aims to crack passwords that are slightly more complex than simple dictionary words but still follow predictable patterns, like 'password123' or 'Summer2024!'. While more comprehensive than a pure dictionary attack, it remains more targeted and less exhaustive than a full brute-force attempt.
✗
Brute-force attack
Why it's wrong here
A brute-force attack involves systematically trying every possible character combination within a defined character set and length until the correct password is discovered. This method is computationally intensive and time-consuming, especially for longer or more complex passwords, making it generally impractical for online login attempts due to network latency, rate limiting, and account lockout policies. Unlike dictionary or hybrid attacks, it guarantees finding the password if given enough time, but at a significantly higher resource cost.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question