PEN-200 Password Attacks Practice Question
You are conducting a penetration test and have obtained a list of usernames. You want to perform a password spray against an OWA (Outlook Web Access) portal. Which tool is specifically designed to automate password spraying against OWA while respecting lockout policies?
⚠ Common exam trap
The trap here is assuming that any password spraying tool can target OWA, when in fact specialized tools like MailSniper are designed for it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MailSniper
MailSniper is a dedicated tool for attacking Exchange and OWA environments. Its `Invoke-PasswordSprayOWA` cmdlet automates the process of trying a single password against multiple OWA accounts while allowing the tester to specify a delay to avoid lockouts. This specialization makes it more effective and safer than generic brute-force tools like Hydra or Medusa, which are not tailored for OWA. CrackMapExec does not support OWA, so MailSniper is the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hydra
Why it's wrong here
Hydra is a versatile online password cracking tool that supports many protocols, including HTTP forms. However, it is not specifically designed for OWA spraying and lacks built-in awareness of Exchange lockout policies. While it can be configured to spray, it requires manual tuning and may not handle OWA's authentication nuances as effectively as MailSniper. Therefore, it is not the best tool for this specific task.
- ✓
MailSniper
Why this is correct
MailSniper is a PowerShell tool designed for penetration testing against Exchange and OWA. It includes a `Invoke-PasswordSprayOWA` function that automates password spraying while allowing control over the delay between attempts to avoid lockouts. It is specifically tailored for OWA and Exchange environments, making it the ideal choice for this scenario. Other tools may support spraying but are not as specialized for OWA.
- ✗
Medusa
Why it's wrong here
Medusa is another parallel login brute-forcer, similar to Hydra. It can target HTTP services but does not have specialized modules for OWA or Exchange. It also lacks features to automatically respect lockout policies, requiring manual configuration. For a targeted OWA spray, Medusa is less efficient and more likely to trigger lockouts than a tool built for that purpose.
- ✗
CrackMapExec
Why it's wrong here
CrackMapExec (NetExec) is primarily used for SMB, WinRM, and other Windows protocols, not OWA. While it can perform password spraying against SMB and LDAP, it does not support OWA directly. Using it for OWA would require custom modules or scripts, making it unsuitable for this scenario. Therefore, it is not the correct tool for spraying against an OWA portal.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.