When testing password strength, which of the following is the BEST method for brute forcing passwords?

An offline attack involves obtaining a copy of the hashed password database and running brute force attempts locally against the hashes, bypassing account lockout policies entirely. This allows an attacker or tester to attempt millions or billions of password combinations per second using tools like Hashcat or John the Ripper without any network-imposed throttling or lockout risk, making it the most thorough and efficient brute force method.

An online password attack sends guesses directly to the authentication service in real time, which is severely limited by account lockout policies and network latency, making it impractical for true brute force testing.

Using a comprehensive word list describes a dictionary attack, which is a specific subset of password guessing that relies on common words rather than exhaustively trying all possible character combinations as true brute forcing requires.

Social engineering is a human-manipulation technique used to trick individuals into revealing credentials and is not a brute force method, as it does not involve systematically guessing or cracking passwords algorithmically.