GCIH · Question #60
Andrew, a bachelor student of Faulkner University, creates a gmail account. He uses 'Faulkner' as the password for the gmail account. After a few days, he starts receiving a lot of e-mails stating…
The correct answer is C. Brute force attack D. Social engineering F. Rainbow attack G. Password guessing H. Dictionary-based attack. Andrew's password 'Faulkner' is weak and contextually predictable, making it vulnerable to multiple password-cracking methods, but not to attacks that target service availability or exploit software memory vulnerabilities.
Question
Andrew, a bachelor student of Faulkner University, creates a gmail account. He uses 'Faulkner' as the password for the gmail account. After a few days, he starts receiving a lot of e-mails stating that his gmail account has been hacked. He also finds that some of his important mails have been deleted by someone. Which of the following methods has the attacker used to crack Andrew's password? Each correct answer represents a complete solution. Choose all that apply.
Options
- ADenial-of-service (DoS) attack
- BZero-day attack
- CBrute force attack
- DSocial engineering
- EBuffer-overflow attack
- FRainbow attack
- GPassword guessing
- HDictionary-based attack
How the community answered
(28 responses)- A7% (2)
- B4% (1)
- C89% (25)
Why each option
Andrew's password 'Faulkner' is weak and contextually predictable, making it vulnerable to multiple password-cracking methods, but not to attacks that target service availability or exploit software memory vulnerabilities.
A Denial-of-Service attack floods or crashes a service to make it unavailable to legitimate users; it provides no mechanism for discovering or recovering a user's password.
A Zero-day attack exploits an unknown, unpatched software vulnerability in an application or OS; it is a system compromise technique and not a method for cracking or guessing account passwords.
Brute force attack systematically tries every possible character combination until the correct password is found; given no account lockout, it will eventually succeed against 'Faulkner'.
Social engineering manipulates Andrew through deception - such as phishing or impersonation - to trick him into voluntarily disclosing his password without any technical cracking required.
A Buffer-overflow attack overwrites memory beyond an allocated buffer boundary to execute arbitrary code or crash a process; it does not extract or recover plaintext passwords from an account.
A Rainbow attack uses precomputed hash-to-plaintext lookup tables to quickly reverse a stored password hash; 'Faulkner' as a proper noun would appear in standard rainbow table wordlists.
Password guessing is especially effective here because 'Faulkner' is directly tied to Andrew's university, making it an obvious first guess for anyone aware of his affiliation.
A dictionary-based attack tries words from precompiled wordlists; 'Faulkner' is a proper noun that commonly appears in extended dictionary and name-based wordlists used in these attacks.
Concept tested: Password attack vectors against weak predictable passwords
Source: https://csrc.nist.gov/glossary/term/dictionary_attack
Topics
Community Discussion
No community discussion yet for this question.