GCIH · Question #74
Adam is a novice Web user. He chooses a 22 letters long word from the dictionary as his password. How long will it take to crack the password by an attacker?
The correct answer is D. 5 minutes. A dictionary attack tests passwords against a precompiled list of real words, so password length is irrelevant if the password is an actual dictionary entry.
Question
Adam is a novice Web user. He chooses a 22 letters long word from the dictionary as his password. How long will it take to crack the password by an attacker?
Options
- A22 hours
- B23 days
- C200 years
- D5 minutes
How the community answered
(58 responses)- A2% (1)
- B3% (2)
- C2% (1)
- D93% (54)
Why each option
A dictionary attack tests passwords against a precompiled list of real words, so password length is irrelevant if the password is an actual dictionary entry.
22 hours assumes a slow brute-force enumeration; a dictionary attack against a known dictionary word completes far faster than that.
23 days would imply extremely slow attack throughput or a highly complex password, neither of which applies to a standard dictionary word.
200 years would apply to a high-entropy, truly random password such as a long string of random alphanumeric characters, not a word found in any dictionary.
Dictionary attacks use wordlists containing real words and phrases; since the password is taken directly from the dictionary, it will be found almost immediately regardless of character length. Modern cracking tools can test millions of dictionary entries per second, making any single dictionary word crackable in seconds to minutes.
Concept tested: Dictionary attack effectiveness against word-based passwords
Source: https://csrc.nist.gov/glossary/term/dictionary_attack
Topics
Community Discussion
No community discussion yet for this question.