GPEN Password Attacks and Credential Testing Quiz

Submit

2. What is the primary purpose of password policy testing during a GPEN assessment?

To verify compliance with organizational security standards

To identify weak passwords and enforce stronger requirements

To document authentication mechanisms for audit purposes

To establish baseline security metrics for future testing

3. Which technique is most effective against systems that implement aggressive account lockout policies?

Dictionary attack

Distributed brute force attack

Rainbow table lookup

Social engineering combined with credential testing

4. True or False: Offline password attacks are generally faster than online attacks because they do not face account lockout mechanisms.

True

False

Submit

6. Which of the following best describes a mask attack in password cracking?

Using predefined patterns to generate candidate passwords

Hiding the true purpose of authentication testing

Masking sensitive data during password transmission

Obfuscating hash values before comparison

7. True or False: Multi-factor authentication completely eliminates password-based attacks.

True

False

8. What is the primary advantage of using a hybrid attack over a pure dictionary attack?

It requires less computational power

It combines dictionary words with numeric and special character variations

It eliminates the need for rainbow tables

It guarantees finding the password

9. Which attack method uses previously compromised credentials from other breaches to gain access?

Spear phishing

Credential stuffing

Shoulder surfing

Keystroke logging

10. True or False: Penetration testers should always obtain written authorization before conducting credential testing.

True

False

11. Which attack method attempts to guess user credentials by trying common username and password combinations?

Dictionary attack

Brute force attack

Rainbow table attack

Social engineering

12. What does a credential stuffing attack exploit?

Weak password hashing algorithms

Reuse of credentials across multiple accounts

Unpatched authentication systems

Poor network segmentation

13. True or False: Using longer passwords always prevents dictionary attacks.

True

False

14. Which of the following is a valid technique for testing credential strength during a penetration test?

Attempting default credentials on systems

Using publicly available password lists

Performing authorized brute force attacks

All of the above

Submit

16. What is the primary purpose of password salting?

Encrypting passwords during transmission

Making identical passwords hash to different values

Increasing password complexity requirements

Logging authentication attempts

17. Which hashing algorithm is considered more resistant to rainbow table attacks due to its computational intensity?

MD5

SHA-1

Bcrypt

CRC32

18. True or False: A brute force attack is more efficient than a dictionary attack when the target password is not a common word.

True

False

Submit

20. What is a rainbow table used for in password attacks?

Storing encrypted passwords securely

Pre-computing hash values for password cracking

Monitoring failed login attempts

Generating random password combinations

GPEN Password Attacks and Credential Testing Quiz

1. Hashcat is primarily used for ____.

2.

What first name or nickname would you like us to use?

2. What is the primary purpose of password policy testing during a GPEN assessment?

3. Which technique is most effective against systems that implement aggressive account lockout policies?

4. True or False: Offline password attacks are generally faster than online attacks because they do not face account lockout mechanisms.

5. During credential testing, a penetration tester discovers that an account uses the password 'Password123'. This indicates a weakness in ____.

6. Which of the following best describes a mask attack in password cracking?

7. True or False: Multi-factor authentication completely eliminates password-based attacks.

8. What is the primary advantage of using a hybrid attack over a pure dictionary attack?

9. Which attack method uses previously compromised credentials from other breaches to gain access?

10. True or False: Penetration testers should always obtain written authorization before conducting credential testing.

11. Which attack method attempts to guess user credentials by trying common username and password combinations?

12. What does a credential stuffing attack exploit?

13. True or False: Using longer passwords always prevents dictionary attacks.

14. Which of the following is a valid technique for testing credential strength during a penetration test?

15. John the Ripper is a tool used for ____.

16. What is the primary purpose of password salting?

17. Which hashing algorithm is considered more resistant to rainbow table attacks due to its computational intensity?

18. True or False: A brute force attack is more efficient than a dictionary attack when the target password is not a common word.

19. Hydra and Medusa are tools primarily used for ____.

20. What is a rainbow table used for in password attacks?