nerdexam
CompTIA

SY0-501 · Question #347

An actor downloads and runs a program against a corporate login page. The program imports a list of usernames and passwords, looking for a successful attempt. Which of the following terms BEST…

The correct answer is A. Script kiddie. The actor downloads and runs a pre-existing program to perform an automated brute-force or credential stuffing attack against a login page, using lists of credentials to find a successful login.

Submitted by yaw92· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

An actor downloads and runs a program against a corporate login page. The program imports a list of usernames and passwords, looking for a successful attempt. Which of the following terms BEST describes the actor in this situation?

Options

  • AScript kiddie
  • BHacktivist
  • CCryptologist
  • DSecurity auditor

How the community answered

(30 responses)
  • A
    80% (24)
  • B
    3% (1)
  • C
    7% (2)
  • D
    10% (3)

Why each option

The actor downloads and runs a pre-existing program to perform an automated brute-force or credential stuffing attack against a login page, using lists of credentials to find a successful login.

AScript kiddieCorrect

A script kiddie is an individual who uses pre-written scripts or programs developed by others to carry out attacks, often without a deep understanding of the underlying technology. The description of the actor downloading and running a program with imported lists perfectly aligns with this definition, as they are leveraging existing tools rather than developing sophisticated exploits.

BHacktivist

A hacktivist is an individual who uses hacking techniques to promote a political or social cause, which is not indicated in the scenario.

CCryptologist

A cryptologist is an expert in cryptography, the science of secure communication, and is not involved in performing brute-force attacks.

DSecurity auditor

A security auditor is a professional who systematically evaluates the security of systems, typically with authorization, to identify vulnerabilities, which is contrary to the unauthorized attack described.

Concept tested: Threat actor types: script kiddie

Source: https://csrc.nist.gov/glossary/term/script_kiddie

Topics

#threat actors#script kiddie#credential stuffing#attack tools

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice