What hacking attack is challenge/response authentication used to prevent?

In a replay attack, an adversary captures valid authentication credentials or tokens and retransmits them later to gain unauthorized access. Challenge/response defeats this because the server generates a fresh, unpredictable challenge nonce for each login attempt, and the valid response is cryptographically tied to that specific nonce. A captured response from a previous session is useless because the next challenge will be different, making the old response invalid.

Scanning attacks involve network reconnaissance such as port scanning and are not related to the authentication mechanism; challenge/response provides no protection against them.

Session hijacking occurs after successful authentication by stealing an active session token; challenge/response only secures the login phase and does not protect the session itself once established.

Password cracking targets the password value itself through brute force or dictionary methods; while challenge/response avoids transmitting the password directly, it is not specifically designed as an anti-cracking control.