CEH Enumeration and System Hacking Practice Question

Which THREE of the following are common techniques used in the 'Cracking passwords' phase of system hacking? (Select 3)

⚠ Common exam trap

Watch out — candidates often confuse password capturing techniques (like keylogging or social engineering) with password cracking techniques that operate on captured hashes or encrypted passwords.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Brute force attack

A brute force attack systematically tries every possible combination of characters until the correct password is found. This is a fundamental technique in the password cracking phase, often used when no prior knowledge of the password exists. It is computationally expensive but guaranteed to succeed given enough time.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Brute force attack
Why this is correct
A brute force attack is an exhaustive password cracking method that systematically attempts every possible character combination (letters, numbers, symbols) of a specified length until the correct password or key is discovered. While computationally intensive, especially for long and complex passwords, it guarantees success given sufficient time and processing resources. This makes it a fundamental and powerful technique in a cracker's arsenal.
✓
Rainbow table attack
Why this is correct
A rainbow table attack utilizes precomputed tables of hash chains to reverse cryptographic hash functions, primarily to recover plaintext passwords from their hashed representations. Instead of computing each hash in real-time, the attacker looks up the target hash in the table to quickly find the corresponding plaintext. This method is highly efficient against unsalted hashes, significantly reducing the time required compared to brute force.
✗
Keylogging
Why it's wrong here
Keylogging involves the surreptitious recording of keystrokes made by a user, typically through malicious software or hardware, to capture sensitive information like usernames and passwords as they are typed. While an effective method for credential theft, it is a form of direct interception or espionage rather than a computational technique for 'cracking' or guessing a password from its encrypted or hashed form. Therefore, it is not a password cracking technique.
✗
Social engineering
Why it's wrong here
Social engineering is a non-technical method that relies on psychological manipulation to trick individuals into divulging confidential information, such as passwords, or performing actions that compromise security. This approach exploits human trust, curiosity, or fear rather than technical vulnerabilities in systems or cryptographic algorithms. Consequently, it is not considered a technical password cracking method, as it bypasses computational challenges entirely.
✓
Dictionary attack
Why this is correct
A dictionary attack attempts to guess passwords by systematically trying every word or phrase from a pre-compiled list, known as a wordlist or dictionary. This list typically includes common words, names, previously leaked passwords, and simple variations, exploiting the common user tendency to choose easily memorable and weak passwords. It is significantly faster and more efficient than a brute force attack for discovering common or predictable passwords.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question