nerdexam
GIAC

GCIH · Question #90

You work as a Network Administrator in the SecureTech Inc. The SecureTech Inc. is using Linux- based server. Recently, you have updated the password policy of the company in which the server will…

The correct answer is A. Brute force. Account lockout policies after a set number of failed attempts directly counter brute force attacks, which rely on trying many password combinations until one succeeds.

Vulnerability Exploitation & Privilege Escalation

Question

You work as a Network Administrator in the SecureTech Inc. The SecureTech Inc. is using Linux- based server. Recently, you have updated the password policy of the company in which the server will disable passwords after four trials. What type of attack do you want to stop by enabling this policy?

Options

  • ABrute force
  • BReplay
  • CXSS
  • DCookie poisoning

How the community answered

(32 responses)
  • A
    88% (28)
  • B
    3% (1)
  • C
    6% (2)
  • D
    3% (1)

Why each option

Account lockout policies after a set number of failed attempts directly counter brute force attacks, which rely on trying many password combinations until one succeeds.

ABrute forceCorrect

A brute force attack works by systematically attempting every possible password combination until the correct one is found. Disabling an account after four failed trials breaks this attack by preventing further guesses, making exhaustive password enumeration impractical. This is a standard and well-recognized defense against online brute force and dictionary attacks.

BReplay

A replay attack captures and retransmits valid authentication messages rather than guessing passwords repeatedly, so lockout policies do not address it.

CXSS

Cross-site scripting (XSS) exploits web application output encoding flaws and is unrelated to repeated failed login attempts.

DCookie poisoning

Cookie poisoning involves tampering with cookie values to manipulate application behavior, not iterating through password guesses.

Concept tested: Brute force attack prevention via account lockout

Source: https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks

Topics

#brute force attack#account lockout#password policy#authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice