• (A) Brute force — one account was targeted with a long list of candidate passwords until one worked.
• (B) Credential stuffing — username-and-password pairs stolen from another site were replayed against this portal.
• (C) Password spraying — one common password was tried once against many accounts to stay below the lockout threshold.
• (D) Rainbow table — a precomputed table of hashes was searched to recover the passwords held by the portal.

• (A) It will not slow this attack at all, because the attacker is testing candidates offline against the stolen file instead of submitting them to the portal.
• (B) It will not slow this attack at all, because account lockout is applied only to administrator accounts and never to standard user accounts.
• (C) It will stop this attack quickly, because every candidate the cracking tool tests is counted as a failed sign-in on that account.
• (D) It will stop this attack quickly, because the stored salt is the value the lockout counter uses to track failed attempts per account.

ACESHACK TICKET #2214 — DROP-IN WORKSTATION SETUP
Device: DROP-IN-WS-03 (shared, used by remote staff for the day)
Finding 1: The local administrator account still uses the vendor
           default password that shipped with the imaging tool.
Finding 2: The sign-in portal stores each password as a hash with
           a unique random salt, kept in the same row as the hash.
ASSESSMENT: Finding 2 is a defect. A salt is a secret, so storing
           it beside the hash cancels its protection entirely.
RECOMMENDATION: Change the default password, set a minimum
           password length, and enable account lockout.

• (A) Nothing is incorrect — every line of the ticket is technically sound as written.
• (B) Finding 1 — a vendor default password is only a vulnerability once the device is reachable from the internet.
• (C) The RECOMMENDATION line — a minimum length and account lockout defend against the same attack and are redundant together.
• (D) The ASSESSMENT line — a salt is not a secret; it is stored beside the hash by design and still defeats precomputed tables.

• I. The setup is multi-factor authentication, because it pairs something the user knows with something the user has.
• II. Replacing the push approval with a security question would make the setup single-factor, because both steps would then be knowledge factors.
• III. The push approval counts as a biometric factor, because the phone that receives it was issued and registered by Aceshack.
• IV. An attacker who recovers this worker’s password from a breach of an unrelated website still cannot sign in without the phone.

1. A random value stored with each password hash, so that two users who choose the same password still end up with different hashes, is called a .

2. An attack that replays username-and-password pairs stolen from one site against a different site is called credential .

3. A precomputed list of candidate passwords with their matching hashes, searched to reverse a stolen hash, is called a table.