nerdexam
GIAC

GCIH · Question #74

Adam is a novice Web user. He chooses a 22 letters long word from the dictionary as his password. How long will it take to crack the password by an attacker?

The correct answer is D. 5 minutes. A dictionary attack tests passwords against a precompiled list of real words, so password length is irrelevant if the password is an actual dictionary entry.

Vulnerability Exploitation & Privilege Escalation

Question

Adam is a novice Web user. He chooses a 22 letters long word from the dictionary as his password. How long will it take to crack the password by an attacker?

Options

  • A22 hours
  • B23 days
  • C200 years
  • D5 minutes

How the community answered

(58 responses)
  • A
    2% (1)
  • B
    3% (2)
  • C
    2% (1)
  • D
    93% (54)

Why each option

A dictionary attack tests passwords against a precompiled list of real words, so password length is irrelevant if the password is an actual dictionary entry.

A22 hours

22 hours assumes a slow brute-force enumeration; a dictionary attack against a known dictionary word completes far faster than that.

B23 days

23 days would imply extremely slow attack throughput or a highly complex password, neither of which applies to a standard dictionary word.

C200 years

200 years would apply to a high-entropy, truly random password such as a long string of random alphanumeric characters, not a word found in any dictionary.

D5 minutesCorrect

Dictionary attacks use wordlists containing real words and phrases; since the password is taken directly from the dictionary, it will be found almost immediately regardless of character length. Modern cracking tools can test millions of dictionary entries per second, making any single dictionary word crackable in seconds to minutes.

Concept tested: Dictionary attack effectiveness against word-based passwords

Source: https://csrc.nist.gov/glossary/term/dictionary_attack

Topics

#dictionary attack#password cracking#weak password selection

Community Discussion

No community discussion yet for this question.

Full GCIH Practice