Credential attacks · Question 9 of 12
An attacker tries the password "Autumn2026!" once on each of 5,000 accounts. What is this attack called, and why is it insidious?
1 answer is correct. Medium
Show answer
Answer
- C Password spraying, because per-account lockouts do not trigger
Explanation
In password spraying, one common password is tried on many accounts, with few attempts per account. Lockout thresholds are thus circumvented. MFA, block lists for common passwords and detecting many failed attempts across many accounts help against it.