CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Account lockout after failed attempts

  Why this is correct

  Account lockout after failed attempts is a highly effective mitigation against brute-force attacks because it directly prevents an attacker from making an unlimited number of password guesses for a specific account. After a predefined threshold of incorrect login attempts is reached, the system temporarily or permanently disables access for that user, forcing the attacker to cease their automated guessing against that particular target. This significantly increases the time and resources required for a successful compromise.

• ✓

  Implementing CAPTCHA

  Why this is correct

  Implementing CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is an effective mitigation as it introduces a challenge designed to be easily solvable by humans but extremely difficult for automated scripts or bots. By requiring users to successfully complete a CAPTCHA before submitting login credentials, it effectively thwarts automated brute-force attempts that rely on rapid, programmatic submission of numerous password guesses without human interaction.

• ✓

  Rate limiting on login endpoints

  Why this is correct

  Rate limiting on login endpoints is a crucial mitigation that restricts the number of login attempts allowed from a single IP address or user within a specified timeframe. This mechanism significantly slows down automated brute-force attacks by preventing attackers from submitting a high volume of password guesses per second. By enforcing a delay or temporary block after a certain number of failed attempts, it makes the attack impractical due to the extended time required for success.

• ✗

  Enforcing strong password policies

  Why it's wrong here

  Enforcing strong password policies, while beneficial for resisting dictionary attacks and making individual passwords harder to guess, does not inherently prevent brute-force attempts. An attacker can still systematically try every possible character combination against a strong password. The policy itself doesn't stop the *attempt* to brute-force; it only increases the computational effort and time required for a successful compromise if the password is truly random and long.

• ✗

  Using HTTP basic authentication

  Why it's wrong here

  Using HTTP Basic Authentication offers no effective mitigation against brute-force attacks and can even facilitate them. This authentication method transmits credentials in base64 encoding, which is trivial to decode, and lacks any built-in mechanisms such as account lockout, rate limiting, or session management. Consequently, it is highly susceptible to automated credential stuffing or password guessing attempts, providing no inherent protection against such attacks.

Go deeper

Related to this question