220-1102 Question 448
Single answerDictionary attackA help desk technician notices repeated failed sign-in attempts against several employee accounts in the company’s Microsoft 365 tenant. The usernames are valid, and the failed passwords follow common patterns such as seasons, company name variations, and simple words. The security team confirms the source is trying large numbers of likely passwords from a rotating list. Which type of attack is the company most likely experiencing?
- A
Dictionary attack
- B
Shoulder surfing
- C
Evil twin attack
- D
Privilege escalation
Show answer and explanation
Correct answer: A
Explanation
The best answer is Dictionary attack. In A+ Core 2, candidates should recognize common attack types by their real-world signs. A dictionary attack relies on prebuilt lists of common passwords, words, and predictable variations rather than trying every possible character combination. The clue here is the use of common, human-chosen password patterns such as seasons and company-related words. This differs from brute-force attacks, which systematically try all combinations, and from unrelated threats like shoulder surfing or evil twin attacks. Best practices recommended by major vendors and security guidance, including Microsoft and NIST password guidance, include enforcing strong password policies, blocking commonly used passwords, enabling multifactor authentication, and using account lockout or smart lockout protections to reduce the success of password-guessing attacks.
- A. Correct.
Correct. A dictionary attack uses a list of common words, phrases, and predictable password variations to try to gain access to accounts. In this scenario, the attacker is attempting many likely passwords such as seasons and company-related terms, which matches the behavior of a dictionary-based password attack.
- B. Incorrect.
Incorrect. Shoulder surfing is a physical security threat where someone observes a user entering credentials or sensitive information. The scenario describes automated repeated sign-in attempts using likely password lists, not visual observation of a user.
- C. Incorrect.
Incorrect. An evil twin attack involves a rogue wireless access point impersonating a legitimate Wi-Fi network to trick users into connecting. The scenario is focused on account sign-in attempts against cloud identities, not wireless network impersonation.
- D. Incorrect.
Incorrect. Privilege escalation occurs when an attacker who already has some level of access exploits a weakness to gain higher permissions. In this case, the attacker is still attempting to authenticate by guessing passwords and has not yet gained initial access.