11.7.8 Password Attacks

In a variation of the brute force attack, an attacker may use a predefined list of common usernames and passwords to gain access to existing user accounts. Which countermeasure best addresses this issue?

A strong password policy

Which of the following strategies can protect against a rainbow table password attack?

Add random bits to the password before hashing takes place

You want to check a server for user accounts that have weak passwords. Which tool should you use?

John the Ripper

Which of the following techniques involves adding random bits of data to a password before it is stored as a hash?

Password salting

Which of the following password attacks uses preconfigured matrices of hashed dictionary words?

Rainbow table attack

Carl received a phone call from a woman who states that she is calling from his bank. She tells him that someone has tried to access his checking account, and she needs him to confirm his account number and password to discuss further details. He gives her his account number and password. Which of the following types of non-technical password attack has occurred?

Social engineering

Which of the following best describes shoulder surfing?

Someone nearby watching you enter your password on your computer and recording it.

You are cleaning your desk at work. You toss several stacks of paper in the trash, including a sticky note with your password written on it. Which of the following types of non-technical password attacks have you enabled?

Dumpster diving

You are using a password attack that tests every possible keystroke for each single key in a password until the correct one is found. Which of the following technical password attacks are you using?

Brute force attack

A user named Bob Smith has been assigned a new desktop workstation to complete his day-to-day work. When provisioning Bob's user account in your organization's domain, you assigned an account name of BSmith with an initial password of bw2Fs3d. On first login, Bob is prompted to change his password. He changes it to the name of his dog, Fido. What should you do to increase the security of Bob's account? (Select two.)

Use Group Policy to require strong passwords on user accounts. Train users not to use passwords that are easy to guess.