nerdexam
Exams312-50V9Questions#583
EC-Council

312-50V9 · Question #583

312-50V9 Question #583: Real Exam Question with Answer & Explanation

The correct answer is D: Hybrid Attack. A hybrid attack is fastest here because users under complexity requirements tend to construct passwords by appending numbers or symbols to familiar words, and hybrid attacks systematically apply exactly those mutations to dictionary candidates.

Question

You have retrieved the raw hash values from a Windows 2000 Domain Controller. Using social engineering, you come to know that they are enforcing strong passwords. You understand that all users are required to use passwords that are at least 8 characters in length. All passwords must also use 3 of the 4 following categories: lower case letters, capital letters, numbers and special characters. With your existing knowledge of users, likely user account names and the possibility that they will choose the easiest passwords possible, what would be the fastest type of password cracking attack you can run against these hash values and still get results?

Options

  • AOnline Attack
  • BDictionary Attack
  • CBrute Force Attack
  • DHybrid Attack

Explanation

A hybrid attack is fastest here because users under complexity requirements tend to construct passwords by appending numbers or symbols to familiar words, and hybrid attacks systematically apply exactly those mutations to dictionary candidates.

Common mistakes.

  • A. An online attack submits guesses directly against the live authentication system, making it extremely slow and subject to account lockout policies that would halt the attempt quickly.
  • B. A pure dictionary attack would fail against passwords that meet the 3-of-4 complexity rule because most plain dictionary words do not contain numbers or special characters.
  • C. A brute force attack against passwords of 8 or more characters drawn from a mixed character set would require an impractically long time compared to a knowledge-guided hybrid approach.

Concept tested. Hybrid password cracking attack against complexity policies

Reference. https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/passwords-overview

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice