Which Command Enables Password Spraying Without Locking Accounts?
Short answer
D cme smb 192.168.0.0/24 -u /userList.txt -p Summer123
Question
Key Takeaways
The exam tests whether you can distinguish password spraying (many users, one password) from brute forcing (many passwords, one user) to prevent account lockouts; the common trap is selecting an option that uses a password list, risking lockout.
This CompTIA PT0-002 question tests your ability to identify a password spray attack command that avoids account lockouts. The community consensus is that answer D is correct because it uses a single password against a list of users, which is the signature of a safe password spray.
Common mistake: Option C is the most common wrong answer because it uses CrackMapExec with both a user list and a password list, but that is a brute force approach that can lock accounts, whereas the question requires a password spray.
Expert Analysis
Why the Answer Is Correct
Answer D (cme smb 192.168.0.0/24 -u /userList.txt -p Summer123) is a classic password spray command. It iterates through a list of usernames while using a single password, which minimizes the risk of account lockouts. Comment [1] explicitly notes that this is a password spraying attack and the only option that tests a list of users against a single password. Comment [2] also states that D is essentially a password spray attack.
Why the Other Options Are Wrong
Option A uses enum4linux with a password list against a single user, which is a brute force attack and can lock the account. Option B uses a single password for a single user, but that only tests one account and is not suitable for "any account in the domain." Option C uses a password list with multiple users, again risking lockout; community comment [3] notes that CrackMapExec can be used for password spray attacks, but this command is configured as a brute force attack, not a spray.
Community Comment Notes
The comments strongly support answer D. Comment [1] (4 likes) provides the key rationale: we cannot know how many passwords are in the list for C, so lockout risk exists. Comment [2] (2 likes) reinforces D as a password spray. Comment [3] (1 like) explains that cme is the right tool but highlights that the command syntax determines the attack type. No comments challenged D, and the 100% vote distribution confirms the consensus.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
When you see a question about avoiding account lockouts, immediately think password spraying: one password, many usernames. Look for the option that contains a single password (like Summer123) and a user list (like -u /userList.txt), and ignore options that include password lists because they are brute force attempts.
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Snagggggin 👍 4 Answered DThis is describing a password praying attack. We have no idea of knowing how many passwords are in the list described in answer C, and therefore there is a risk of lockout. Answer D is the only one that will test a list of users against a single password, ensuring there is no lockouts.
-
hitagitore 👍 2 Answered DD is basically a password spray attack,
-
killwitch 👍 1 Answered Dcme (CrackMapExec) can be used for password spray attack.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.