Compromising Credentials via Offline Brute-Force

SY0-601 By islever Editorial Last updated

Short answer

A The former employee can perform an offline brute-force attack against the stolen encrypted_passwords.db file to recover plaintext passwords.

Question

An audit report showed that a former employee saved the following files to an external USB drive before the employee's termination date: • annual_tax_form.pdf • encrypted_passwords.db • team_picture.jpg • contact_list.db • human_resources.txt Which of the following could the former employee do to potentially compromise corporate credentials?
  1. Perform an offline brute-force attack Correct Answer
  2. Use the files to create a rainbow table.
  3. Conduct a token replay.
  4. Release a network dictionary attack.

Key Takeaways

The core concept is distinguishing between online and offline attacks; the trap is confusing rainbow table creation with the active process of brute-forcing known hashes.

This question tests knowledge of password attack vectors when sensitive data like encrypted password databases is exfiltrated. The correct answer identifies the offline brute-force attack as the primary method for cracking stolen hashes.

Common mistake: Many candidates incorrectly select 'Use the files to create a rainbow table' because they recognize the presence of hashed passwords but misunderstand that creating a new rainbow table is impractical compared to directly brute-forcing the specific stolen hashes.

Expert Analysis

Why the Answer Is Correct

A former employee who steals an 'encrypted_passwords.db' file possesses the cryptographic hashes of user passwords. Since the attacker has the target hashes in hand, they can perform an offline brute-force attack, trying millions of password guesses per second without interacting with the live network or triggering account lockouts. This makes it the most direct and effective method for compromising credentials from the stolen file.

Why the Other Options Are Wrong

Option B is incorrect because while rainbow tables are used for reversing hashes, creating a custom rainbow table for specific salts or unique hash algorithms is computationally expensive and often unnecessary when standard brute-force or dictionary tools can be run directly against the stolen file. Option C, token replay, requires capturing active authentication tokens, not static database files. Option D refers to a network-based attack where guesses are sent over the wire, which contradicts the scenario of having local access to exfiltrated data.

Community Comment Notes

Community consensus strongly favors the offline brute-force approach. As salah112 noted, the attacker attempts various combinations against the encrypted file to discover original passwords. Yomzie emphasized that offline attacks allow hackers to try keys without risk of discovery. While some users initially considered rainbow tables, the prevailing view supports the direct brute-force capability enabled by the stolen database.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-63b/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see 'exfiltrated' or 'stolen' data containing hashes, immediately think 'offline'. If the data is live traffic, think 'online' or 'replay'. Always match the attack vector to the attacker's immediate resources.

Frequently Asked Questions

Why not create a rainbow table?

Creating a rainbow table is often impractical due to storage requirements and salt usage. Directly brute-forcing the specific stolen hashes is faster and more efficient.

What is the difference between online and offline brute-force?

Online attacks interact with the live system and risk detection/lockouts. Offline attacks use stolen data locally, allowing unlimited attempts without immediate detection.

More SY0-601 FAQ →

Community Votes

A
78%
B
22%

78% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. salah112 👍 4 Answered A
    A. Perform an offline brute-force attack The former employee, having obtained files such as "encrypted_passwords.db" and "human_resources.txt," could potentially perform an offline brute-force attack on the encrypted passwords. In an offline brute-force attack, the attacker attempts various combinations of passwords against the encrypted file to discover the original passwords. If the encryption is weak or the passwords are not properly hashed and salted, this type of attack could be successful.
  2. Yomzie 👍 3
    Brute-force attacks can take place both offline or online. For an offline attack, the hacker would have access to the encrypted password hashes and try different key without the risk of discovery or interference.
  3. spencer0328 👍 2 Answered B
    absolutely B Rainbow tables are precomputed tables used for reversing cryptographic hash functions, often used in password attacks. The presence of the "encrypted_passwords.db" file suggests that it contains hashed passwords. By using this file to create a rainbow table, the former employee could potentially compromise corporate credentials by quickly cracking hashed passwords and gaining unauthorized access to systems and accounts
  4. jkalfo 👍 2
    nobody is saying it but i chose b at first . but the f-employee could USE a rainbow table , but i dont think he could create one
  5. Hs1208 👍 1 Answered A
    A. Perform an offline brute-force attack ,having saved files such as "encrypted_passwords.db,".
Show 2 more comments
  1. AspiringNerd 👍 1 Answered A
    Believe the answer is offline brute-force attack.
  2. shady23 👍 1 Answered A
    Perform an offline brute-force attack

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide