What hacking attack is challenge/response authentication used to prevent?

In a replay attack, an attacker captures valid authentication data and reuses it later to gain access. Challenge/response defeats this because each authentication cycle presents a new, unique challenge - a previously captured response will not match the next challenge, rendering replayed credentials invalid.

Scanning attacks involve probing network ports or hosts for vulnerabilities and are not mitigated by authentication protocols.

Session hijacking occurs after authentication is complete and targets an established session token, not the credential exchange itself.

Password cracking involves brute-forcing or guessing credentials offline; challenge/response does not directly limit the ability to crack a password hash if one is obtained.