Which approach is recommended to prevent a DoS condition due to account lockouts as a result of a password guessing attack?

Question

Options

• ALimit the attack to a small number of dormant accounts, and maximize the number of password
• BMaximize the number of accounts and hosts that are targeted, but try only two password guesses
• CEmploy a hybrid attack during non-business hours
• DUse a script to automate password guesses at the accounts, limiting the guesses to 1 per every

• A
  9% (2)
• B
  82% (18)
• C
  5% (1)
• D
  5% (1)

Explanation

It is common for an account to become locked (temporarily) after x number of consecutive bad password attempts; it is uncommon to lock the account after only two-consecutive guesses. To avoid account lockout when performing password guessing, some attackers employ an alternative means for testing their guessed passwords password spraying. With this technique, instead of trying a large number of passwords for a small number of accounts on a small number (traditional password guessing), attackers choose a small number of potential passwords to try. They then spray these potential password guesses across a large number of account names and machines, hoping that one works.

No community discussion yet for this question.