Breach Containment: Classify the Damage

The DBA has exported 5 rows from the users table. Each row uses a different password storage implementation. For each entry, classify the storage method and identify the most effective attack an attacker who has this data would use.

Incident Response: Read the Attack Log

The SIEM has flagged unusual authentication activity. Below is a 16-line excerpt from the auth log. Three distinct attack patterns are embedded. Read carefully before answering the questions.

Question 1 (2 pts): Lines 1–9 show which attack type targeting ellen.park?

• ACredential stuffing — the attacker has a confirmed valid credential for ellen.park from a prior breach
• BOnline brute force — the attacker is making repeated failed attempts against a single account from one IP, triggering lockout after 8 attempts
• CPassword spraying — the attacker is using one common password across multiple accounts to avoid lockout
• DRainbow table attack — the attacker is attempting to match ellen.park’s hash to a precomputed table

Question 2 (2 pts): Lines 10–15 show which attack type?

• AOnline brute force — the attacker is testing many passwords against each account from the same IP
• BCredential stuffing — the attacker has breach data with working passwords for each account
• CPassword spraying — the same password “Summer2026!” is tested once per account from one IP, and line 13 shows it succeeded against david.kim
• DDictionary attack — the attacker is trying a pre-defined wordlist of common passwords against one account

Question 3 (3 pts): Lines 15–16 are flagged by the SIEM as suspicious. What attack type do they suggest, and why is it MORE dangerous than the attacks on lines 1–15?

• ABrute force — it is more dangerous because it uses multiple IPs to avoid lockout
• BCredential stuffing — each login succeeds on the first attempt from different IPs with no failures, generating no alerts; the attacker has valid credentials from a prior breach and the lockout policy provides zero protection
• CPassword spraying — it is more dangerous because it uses a different common password per account
• DInsider threat — the accounts are logging in from internal IPs during off-hours, suggesting employees with legitimate access are misusing credentials

Question 4 (3 pts): The CISO asks: “What single control would have prevented david.kim’s account (line 13) from being compromised, even though ‘Summer2026!’ was his actual password?”

• ALower the lockout threshold from 8 attempts to 3 attempts per account
• BRequire a minimum 16-character password, making “Summer2026!” non-compliant at registration
• CDeploy multi-factor authentication — even with the correct password, the attacker cannot pass the second factor without access to david.kim’s device or app
• DBlock the IP 45.33.32.156 after three failed attempts across any accounts in a 60-second window

Post-Breach: Fix the Password Policy

The CISO shares SecureBank’s current password policy. Using NIST SP 800-63B as your reference, classify each policy item as Compliant or a Violation. Two items are compliant; three are violations.