Which Attacks Does Human Verification Protect Against?
Short answer
AB Brute-force Dictionary
Question
Key Takeaways
Tests recognition of CAPTCHA as an anti-automation control, with the common trap being confusion between automated credential attacks and human-targeted social engineering threats.
This question evaluates understanding of CAPTCHA as an anti-automation security control. Community consensus confirms that human verification mechanisms effectively neutralize brute-force and dictionary attacks by blocking bot-driven login attempts.
Common mistake: Candidates frequently select Phishing or Shoulder Surfing because they misinterpret 'human verification' as user education or physical security, overlooking that the question specifically targets automated login scripts.
Expert Analysis
Why the Answer Is Correct
CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart, a control designed to block automated scripts. By forcing manual interaction during login, it drastically reduces the request rate, making high-speed credential testing unfeasible. This directly mitigates brute-force and dictionary attacks, which depend on rapid, machine-generated attempts.
Why the Other Options Are Wrong
On-path attacks exploit network routing flaws to intercept traffic, rendering human verification irrelevant. Phishing relies on social engineering and psychological manipulation rather than automated login scripts. Shoulder surfing is a physical security breach involving visual theft of credentials, completely unrelated to digital authentication flows.
Community Comment Notes
High-voted comments consistently identify the question’s description as a direct reference to CAPTCHA implementation. Test-takers noted the slightly awkward phrasing but agreed that recognizing the anti-bot mechanism was essential to selecting the correct options. Multiple candidates confirmed encountering this exact scenario on their live exams, validating the community consensus.
Official Reference
https://cwe.mitre.org/data/definitions/798.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When encountering vague descriptions like "verify human user," immediately map them to CAPTCHA or MFA controls. Focus on whether the attack relies on automation; if yes, human verification will always be the intended countermeasure in CompTIA scenarios.
Community Votes
100% of anonymous learners picked answer AB. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 8 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 8
-
13thFloor 👍 12AB - the poorly worded question is referring to CAPCTHA - verifying you're not a robot.
-
laosythai 👍 4FFS I picked the wrong answer because whoever wrote this question English must be their 3rd or 4th language…
-
tempovpn 👍 4I got this question on my exam yesterday. It's about CAPTCHA 100%
-
huradazimi 👍 1The attacks that can be effectively protected against by using techniques to check if a connection was made by a human user are Brute-force and Dictionary attacks. These techniques often involve CAPTCHA or similar methods to ensure that the connection attempts are made by a human rather than automated scripts.
-
Soullifespirit 👍 1ChatGPT The attacks that can be effectively protected against by using techniques to check if a connection was made by a human user are: D. Phishing E. Shoulder surfing
Show 3 more comments
-
priestb3 👍 13i got a stroke reading this
-
priestb3 👍 5Captcha..
-
subaie503 👍 5CAPTCHA
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.