GCIH Attacking Passwords Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using a pass-the-hash attack with captured NTLM hashes

  Why it's wrong here

  Pass-the-hash uses captured NTLM hashes to authenticate without knowing the plaintext password, bypassing the need to guess passwords. However, it requires prior compromise to obtain hashes and does not help in testing password strength from a list of usernames. It is not a password-guessing technique and does not address the lockout concern in this scenario.

• ✓

  Using a tool that performs a single authentication attempt per account per lockout window

  Why this is correct

  Limiting each account to one failed attempt per lockout window ensures the account never reaches the lockout threshold. Tools like Spray or custom scripts can enforce this by tracking attempts and waiting the requisite time. This approach allows the tester to test one password per account per window, gradually building a list of valid credentials without locking accounts.

• ✗

  Brute-forcing each account with a large dictionary until a valid password is found

  Why it's wrong here

  Brute-forcing a single account with many password guesses will quickly exceed the five-failure lockout threshold, locking the account. This not only alerts defenders but also prevents further testing against that account until the lockout duration expires. It is the opposite of a lockout-aware strategy and is not appropriate when lockout policies are enforced.

• ✓

  Password spraying with a single common password against all accounts, waiting between attempts

  Why this is correct

  Password spraying tries one password against many accounts, spacing attempts to stay below the lockout threshold per account. By using a single password and waiting between rounds, the tester avoids triggering the five-failure lockout for any individual account. This technique is effective for finding accounts with common weak passwords like 'Password123' without causing widespread lockouts.

• ✗

  Performing a credential stuffing attack using passwords from previous breaches

  Why it's wrong here

  Credential stuffing uses known username/password pairs from other breaches, but it still involves multiple authentication attempts per account if the first guess fails. If the tester tries several breached passwords for a single account, the lockout threshold can be reached. Without careful rate limiting, credential stuffing can cause lockouts and is not inherently lockout-safe.