nerdexam
CompTIA

SY0-501 · Question #200

An auditor is reviewing the following output from a password-cracking tool: User:1: Password1 User2: Recovery! User3: Alaskan10 User4: 4Private User5: PerForMance2 Which of the following methods did…

The correct answer is A. Hybrid. The cracked passwords all follow a pattern of a common word combined with numbers or special characters, which is the hallmark of a hybrid attack that combines dictionary words with additional mutations.

Submitted by andreas_gr· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

An auditor is reviewing the following output from a password-cracking tool:

User:1: Password1 User2: Recovery! User3: Alaskan10 User4: 4Private User5: PerForMance2 Which of the following methods did the author MOST likely use?

Options

  • AHybrid
  • BDictionary
  • CBrute force
  • DRainbow table

How the community answered

(24 responses)
  • A
    75% (18)
  • B
    4% (1)
  • C
    4% (1)
  • D
    17% (4)

Why each option

The cracked passwords all follow a pattern of a common word combined with numbers or special characters, which is the hallmark of a hybrid attack that combines dictionary words with additional mutations.

AHybridCorrect

A hybrid attack combines dictionary words with brute-force mutations such as appending numbers, capitalizing letters, or adding special characters. All five passwords (e.g., 'Password1', 'Recovery!', 'PerForMance2') consist of recognizable dictionary words modified with numbers or symbols, which is exactly the technique a hybrid attack automates by taking wordlist entries and applying rule-based transformations.

BDictionary

A pure dictionary attack uses wordlist entries as-is without modification, and none of the cracked passwords are plain dictionary words - they all contain appended numbers or symbols that a simple dictionary attack would not produce.

CBrute force

Brute force systematically tries every possible character combination without any linguistic basis, making it statistically very unlikely to produce five passwords that all happen to be recognizable English words with minor modifications.

DRainbow table

A rainbow table attack uses precomputed hash chains to reverse password hashes and does not describe a cracking methodology based on word patterns or mutations; it is a lookup technique, not a generation strategy.

Concept tested: Hybrid password attack combining dictionary and brute force

Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/password-spray-attacks?view=o365-worldwide

Topics

#hybrid attack#password cracking#dictionary attack#authentication

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice