Exam PT0-002 topic 1 question 275 discussion

Actual exam question from CompTIA's PT0-002

Question #: 275
Topic #: 1

A penetration tester learned that when users request password resets, help desk analysts change users' passwords to 123change. The penetration tester decides to brute force an internet-facing webmail to check which users are still using the temporary password. The tester configures the brute-force tool to test usernames found on a text file and the password 123change.

Which of the following techniques is the penetration tester using?

A. Brute-force attack
B. LDAP injection
C. Password spraying
D. Kerberoasting

Show Suggested Answer

Suggested Answer: C 🗳️

by ACMaverick at Oct. 22, 2023, 11:56 p.m.

Comments

Submit Cancel

Alizade

7 months, 3 weeks ago

Selected Answer: C

C. Password spraying.

upvoted 2 times

...

ACMaverick

8 months ago

Selected Answer: C

The penetration tester is using password spraying technique. Password spraying is a type of brute-force attack that uses a single password (in this case, 123change) and tries it against multiple usernames. The objective is to identify accounts that are still using the temporary password. Option A (Brute-force attack) is a general term used to describe attacks that involve trying multiple passwords or passphrases with the hope of eventually guessing the correct one. Password spraying is a type of brute-force attack. Option B (LDAP injection) is an attack that exploits vulnerabilities in LDAP (Lightweight Directory Access Protocol) implementations to execute unauthorized queries or commands. This technique is not related to password spraying. Option D (Kerberoasting) is an attack that targets Kerberos authentication protocol to extract service account credentials from Active Directory domain controllers. This technique is not related to password spraying.

upvoted 1 times

...