Compromising Credentials via Offline Brute-Force
An audit report showed that a former employee saved the following files to an external USB drive before the employee's termination date: • annual_tax_form.pdf • encrypted_passwords.db • team_picture.jpg • contact_list.db • human_resources.txt Which of the following could the former employee do to potentially compromise corporate credentials?
Community Votes
78% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept is distinguishing between online and offline attacks; the trap is confusing rainbow table creation with the active process of brute-forcing known hashes.
This question tests knowledge of password attack vectors when sensitive data like encrypted password databases is exfiltrated. The correct answer identifies the offline brute-force attack as the primary method for cracking stolen hashes.
Many candidates incorrectly select 'Use the files to create a rainbow table' because they recognize the presence of hashed passwords but misunderstand that creating a new rainbow table is impractical compared to directly brute-forcing the specific stolen hashes.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A former employee who steals an 'encrypted_passwords.db' file possesses the cryptographic hashes of user passwords. Since the attacker has the target hashes in hand, they can perform an offline brute-force attack, trying millions of password guesses per second without interacting with the live network or triggering account lockouts. This makes it the most direct and effective method for compromising credentials from the stolen file.Why the Other Options Are Wrong
Option B is incorrect because while rainbow tables are used for reversing hashes, creating a custom rainbow table for specific salts or unique hash algorithms is computationally expensive and often unnecessary when standard brute-force or dictionary tools can be run directly against the stolen file. Option C, token replay, requires capturing active authentication tokens, not static database files. Option D refers to a network-based attack where guesses are sent over the wire, which contradicts the scenario of having local access to exfiltrated data.Community Comment Notes
Community consensus strongly favors the offline brute-force approach. As salah112 noted, the attacker attempts various combinations against the encrypted file to discover original passwords. Yomzie emphasized that offline attacks allow hackers to try keys without risk of discovery. While some users initially considered rainbow tables, the prevailing view supports the direct brute-force capability enabled by the stolen database.Official Reference
Exam Strategy
When you see 'exfiltrated' or 'stolen' data containing hashes, immediately think 'offline'. If the data is live traffic, think 'online' or 'replay'. Always match the attack vector to the attacker's immediate resources.
Frequently Asked Questions
Why not create a rainbow table?
Creating a rainbow table is often impractical due to storage requirements and salt usage. Directly brute-forcing the specific stolen hashes is faster and more efficient.
What is the difference between online and offline brute-force?
Online attacks interact with the live system and risk detection/lockouts. Offline attacks use stolen data locally, allowing unlimited attempts without immediate detection.