Ricardo has discovered the username for an application in his targets environment. As he has a limited amount of time, he decides to attempt to use a list of common passwords he found on the…

A known plaintext attack is a cryptanalysis technique where the attacker possesses both the plaintext and its corresponding ciphertext to derive an encryption key - it is unrelated to testing passwords against a login application.

Password spraying tests one or a very small number of common passwords against a large number of different accounts to avoid lockouts - Ricardo is testing many passwords against a single account, which is the reverse approach.

A brute force attack uses automated tooling to systematically attempt credential combinations until the correct one is found; in this exam context, Ricardo's use of a password-cracking application that iterates through a compiled list against a single known username falls under the brute force category. The defining characteristic here is the automated, exhaustive trial of credentials using a tool rather than any manual or analytical method.

A dictionary attack specifically uses a predefined wordlist of common words and passwords to test against credentials - while the scenario resembles this technique, the exam designates automated list-based password testing as brute force in this context.