LabYard_

Credential Attacks

Answer all 15 questions, then submit. You need 75% to pass. If you don't pass, the reattempt unlocks after 24 hours.

Q1. Privilege escalation may exploit:

Design flaws, programming errors, bugs and configuration oversights Only backups Only antivirus Only strong passwords

Q2. A password attack that tries every possible combination is called:

Phishing Dictionary attack Brute-force attack Rainbow-table attack

Q3. A typical rootkit may include:

Backdoors and log-wiping utilities Only antivirus software Only office applications Only backup tools

Q4. Hashcat achieves high speed primarily by:

Using GPU parallelism Compressing the wordlist Using more memory Using the network

Q5. The most popular cover for image steganography is:

A network switch A DNS server A firewall A graphic image

Q6. The main purpose of covering tracks is to:

Test the backups Delay detection and hinder incident response Improve performance Free disk space

Q7. Credential stuffing succeeds mainly because users:

Reuse the same password across multiple services Choose short passwords Use password managers Write passwords down

Q8. A rainbow-table attack relies on:

Port scanning Live online guessing Precomputed hash-to-plaintext lookup tables Social engineering

Q9. Signature-based rootkit detection uses:

Only user names Only DNS records Known rootkit fingerprints Only network speed

Q10. Which is an image steganography technique?

Password spraying Port forwarding Least Significant Bit insertion DNS enumeration

Q11. Which is a defense against privilege escalation?

Default passwords Unrestricted logon Disabling patches Least privilege

Q12. UAC bypass techniques aim to:

Escalate to SYSTEM directly Disable Defender Crack the admin password Run code with elevated rights without showing a consent prompt

Q13. A physical keylogger is placed:

In a firewall rule On a web page Inside a DNS server Between the keyboard hardware and operating system

Q14. Privilege escalation is used to:

Reduce privileges Gain higher privileges such as administrative access Create backups Encrypt all files

Q15. A golden ticket attack requires the attacker to have:

A user password The krbtgt account hash A valid certificate Physical access

LabYard · hands-on security & data training · flags look like ctflab{...}