Password Attacks

Question 1 of 6

A security analyst notices that 500 different employee accounts each received exactly one failed login attempt within a 20-minute window, all using the password "123456." No account was locked out. Which attack type best describes this activity?

Online brute force — the attacker is systematically iterating through the password space against multiple accounts. Offline brute force — the attacker has obtained the hash file and is testing password hashes locally. Password spraying — the attacker tried one common password across many accounts, staying below each account's lockout threshold. Plaintext exposure — the attacker is reading the unencrypted credential database directly.

Question 2 of 6

An attacker obtains a copy of a web application's database containing hashed user passwords. They then run a cracking tool on their own workstation that computes millions of candidate password hashes per second and compares them to the stored digests. What is the primary reason this attack is operationally more dangerous than an online brute force attack?

The attacker can try passwords that contain special characters, which online attacks cannot submit through standard login forms. The attack operates against a local copy with no network latency, no lockout policy, and no logging at the victim system — enabling unrestricted computation at GPU speed. The attack bypasses hashing by reversing the hash function using the attacker's GPU. Offline attacks are faster because the attacker can request the hash values directly from the server's API.

Question 3 of 6

A developer is designing a new application and asks how passwords should be stored. Which answer is correct?

Passwords should be stored using symmetric encryption so they can be retrieved and displayed to users who forget them. Passwords should be stored in plaintext inside a database protected by a strong firewall. Passwords should be hashed using a strong algorithm before storage; the hash is compared to the hash of the submitted password during authentication — the original password is never stored or recoverable. Passwords should be stored as Base64-encoded strings to make them human-unreadable while retaining reversibility.

Question 4 of 6

An account lockout policy locks any account after 5 consecutive failed login attempts. Which password attack does this control MOST effectively mitigate, and which attack does it fail to address?

Most effective against password spraying; fails to address online brute force. Most effective against online brute force; fails to address password spraying (which stays at 1–3 attempts per account) and offline brute force (which never touches the authentication system). Most effective against offline brute force; fails to address online brute force. Most effective against both online and offline brute force; fails only against dictionary attacks.

Question 5 of 6

What is the purpose of salting a password before hashing it?

Salting makes the hash function significantly slower, increasing the time required for each hash computation during offline brute force. Salting encrypts the hash output with a server-side key, preventing the attacker from reading the stored hash even if the database is compromised. Salting adds a unique random value to each password before hashing, ensuring that identical passwords produce different hashes — defeating precomputed rainbow tables and preventing batch cracking of all accounts sharing the same password. Salting adds entropy to the password during transmission, protecting it from interception before it reaches the hashing function.

Question 6 of 6

Which single control is effective against plaintext exposure, password spraying, online brute force, AND offline brute force attacks simultaneously?

Multi-Factor Authentication (MFA) — a correct password alone is insufficient for authentication regardless of how it was obtained or whether it was cracked. Account lockout policy — locks accounts before any attack can succeed. bcrypt hashing — makes all attacks computationally infeasible by slowing hash computation. Password complexity requirements — prevents the use of common passwords that attacks rely on.

Matching — Attack to Definition

Match each term on the left to its correct description on the right.

1. Password Spraying

2. Offline Brute Force

3. Plaintext Password Storage

4. Pre-image Resistance

1. 2. 3. 4.

A. A critical storage vulnerability in which user credentials are saved in their original unencrypted form, making them immediately readable without any computation

B. The hash function property that makes it computationally infeasible to work backward from a stored digest to determine the original password input

C. An attack that tests a few highly common passwords across many user accounts, limiting attempts per account to stay below lockout thresholds

D. An attack that operates against a locally downloaded hash file using full GPU computational power, with no interaction with the victim's authentication system

Password Attacks Quiz

Matching — Attack to Definition