CAS-003 · Question #573
A security consultant was hired to audit a company's password are account policy. The company implements the following controls: - Minimum password length: 16 - Maximum password age: 0 - Minimum…
The correct answer is C. Online hybrid dictionary password spraying attack. With PBKDF2 and salted hashes, offline attacks (A and B) are computationally expensive-PBKDF2 is intentionally slow, making bulk cracking impractical. Rainbow tables (D) are defeated entirely by the use of salting. Pass-the-hash (F) uses captured hashes to authenticate directly…
Question
A security consultant was hired to audit a company's password are account policy. The company implements the following controls:
- Minimum password length: 16
- Maximum password age: 0
- Minimum password age: 0
- Password complexity: disabled
- Store passwords in plain text: disabled
- Failed attempts lockout: 3
- Lockout timeout: 1 hour
The password database uses salted hashes and PBKDF2. Which of the following is MOST likely to yield the greatest number of plain text passwords in the shortest amount of time?
Options
- AOffline hybrid dictionary attack
- BOffline brute-force attack
- COnline hybrid dictionary password spraying attack
- DRainbow table attack
- EOnline brute-force attack
- FPass-the-hash attack
How the community answered
(24 responses)- A4% (1)
- B4% (1)
- C67% (16)
- D17% (4)
- E8% (2)
Explanation
With PBKDF2 and salted hashes, offline attacks (A and B) are computationally expensive-PBKDF2 is intentionally slow, making bulk cracking impractical. Rainbow tables (D) are defeated entirely by the use of salting. Pass-the-hash (F) uses captured hashes to authenticate directly rather than cracking them. Online brute-force (E) is blocked by the 3-attempt lockout. Password spraying (C) avoids lockout by trying a small number of carefully chosen dictionary-based or hybrid passwords across many accounts, so no single account hits the threshold. With password complexity disabled and a 16-character minimum, users likely use common passphrases that are vulnerable to hybrid dictionary attacks. Spraying those across the user base yields credentials while staying under the radar of per-account lockout controls.
Topics
Community Discussion
No community discussion yet for this question.