312-50 Question 315
Single answer▪ Attack Authentication MechanismDuring an authorized internal assessment, you discover that a legacy web application allows users to log in with only a username and password and does not enforce multifactor authentication, account lockout, or rate limiting. The client asks which attack against the authentication mechanism is most practical for an external attacker who has obtained a valid employee username list from public sources and wants to avoid triggering obvious account lockouts. Which attack should you identify as the most likely threat in this scenario?
- A
Password spraying using a small set of common passwords across many usernames
- B
Rainbow table attack against the web application's password database over HTTP
- C
Pass-the-hash attack against the login form using captured NTLM hashes
- D
Kerberoasting against the application server's service accounts
Show answer and explanation
Correct answer: A
Explanation
The most practical attack here is password spraying. From an attacker and defender perspective, password spraying is a common authentication attack when valid usernames are known, especially against services lacking MFA, rate limiting, and lockout protections. It differs from brute force because it minimizes repeated attempts against a single account, reducing the chance of triggering lockout thresholds. This aligns with widely documented guidance from Microsoft, NIST, and OWASP: NIST SP 800-63B discusses throttling and replay resistance as key defenses for authentication systems, while OWASP recommends MFA, login throttling, and monitoring for credential-stuffing and password-spraying patterns. The other options describe different attack classes: rainbow tables are for offline hash cracking, pass-the-hash is generally associated with NTLM-based authentication, and Kerberoasting targets Kerberos service accounts rather than a basic web login form.
- A. Correct.
Correct. Password spraying is specifically effective when an attacker has many valid usernames and wants to avoid account lockouts by trying a few commonly used passwords across many accounts instead of many passwords against one account. In environments without MFA, lockout controls, or rate limiting, this is a practical authentication attack against internet-facing login portals.
- B. Incorrect.
Incorrect. A rainbow table attack is used to crack password hashes offline after obtaining a hashed credential store, especially if hashes are unsalted or weakly protected. It is not something an attacker performs directly against a live web login form over HTTP. This option confuses online authentication attacks with offline hash cracking.
- C. Incorrect.
Incorrect. Pass-the-hash applies primarily to authentication protocols such as NTLM in Windows environments where a hash can be replayed to authenticate without knowing the plaintext password. A standard web form that asks for a username and password does not normally accept NTLM hashes as credentials. This distractor reflects a common misconception that any hash can be reused anywhere as a password substitute.
- D. Incorrect.
Incorrect. Kerberoasting targets Kerberos service tickets in Active Directory environments to obtain crackable ticket-granting material for service accounts. Although relevant in domain attacks, it is not the most practical attack described here because the scenario focuses on a public web application's username/password authentication mechanism, not Kerberos-based service authentication.