Multi-Factor Authentication (MFA) is necessary in many systems given common types of password attacks. Which of the following is a correct list of password attacks?

Masquerading is an identity spoofing attack, salami is a financial fraud technique involving small incremental theft, and polymorphism is a malware evasion technique - none of these are classified as password attacks.

Brute force attacks systematically try all possible password combinations, dictionary attacks use lists of common words/passwords, phishing tricks users into revealing credentials via deceptive communications, and keyloggers capture keystrokes to steal passwords as they are typed. All four are well-established, distinct password attack vectors that MFA directly addresses by requiring a second factor even if the password is compromised.

Zeus is a banking trojan malware family, NetBus is a remote access trojan, and 'rabbit' and 'turtle' are not recognized standard password attack techniques, making this list incorrect.

Token, biometrics, IDS (Intrusion Detection System), and DLP (Data Loss Prevention) are all security controls and defensive technologies, not password attack methods.