Which Command Enables Password Spraying Without Locking Accounts?
A penetration tester wants to find the password for any account in the domain without locking any of the accounts. Which of the following commands should the tester use?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can distinguish password spraying (many users, one password) from brute forcing (many passwords, one user) to prevent account lockouts; the common trap is selecting an option that uses a password list, risking lockout.
This CompTIA PT0-002 question tests your ability to identify a password spray attack command that avoids account lockouts. The community consensus is that answer D is correct because it uses a single password against a list of users, which is the signature of a safe password spray.
Option C is the most common wrong answer because it uses CrackMapExec with both a user list and a password list, but that is a brute force approach that can lock accounts, whereas the question requires a password spray.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Answer D (cme smb 192.168.0.0/24 -u /userList.txt -p Summer123) is a classic password spray command. It iterates through a list of usernames while using a single password, which minimizes the risk of account lockouts. Comment [1] explicitly notes that this is a password spraying attack and the only option that tests a list of users against a single password. Comment [2] also states that D is essentially a password spray attack.Why the Other Options Are Wrong
Option A usesenum4linux with a password list against a single user, which is a brute force attack and can lock the account. Option B uses a single password for a single user, but that only tests one account and is not suitable for "any account in the domain." Option C uses a password list with multiple users, again risking lockout; community comment [3] notes that CrackMapExec can be used for password spray attacks, but this command is configured as a brute force attack, not a spray.Community Comment Notes
The comments strongly support answer D. Comment [1] (4 likes) provides the key rationale: we cannot know how many passwords are in the list for C, so lockout risk exists. Comment [2] (2 likes) reinforces D as a password spray. Comment [3] (1 like) explains that cme is the right tool but highlights that the command syntax determines the attack type. No comments challenged D, and the 100% vote distribution confirms the consensus.Official Reference
Exam Strategy
When you see a question about avoiding account lockouts, immediately think password spraying: one password, many usernames. Look for the option that contains a single password (like Summer123) and a user list (like -u /userList.txt), and ignore options that include password lists because they are brute force attempts.