CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question

A login endpoint has no lockout or rate limiting. An attacker uses Burp Suite's Intruder tool with a 10,000-entry password list. What is this attack called and what is the primary mitigation?

A.Credential stuffing; mitigated by checking breach databases
B.Online password brute-forcing; primary mitigation is account lockout or progressive delays after N failed attempts, combined with rate limiting per IP and per account
C.Rainbow table attack; mitigated by salted hashing
D.Dictionary attack; mitigated by password complexity requirements

Why B is correct

Online brute-force tests many passwords against a single account's login endpoint in real time. Defenses: account lockout (block after N failures, but risk DoS), progressive delay (exponential back-off), rate limiting per IP and account, CAPTCHA, MFA, and alerting on unusual login patterns. Lockout must balance security against DoS on legitimate users.

Know someone studying for Web App Fundamentals? Send them this one.

A login endpoint has no lockout or rate limiting. An attacker uses Burp Suite's Intruder tool with a 10,000-entry password list. What is this attack called and what is the primary mitigation?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

A login endpoint has no lockout or rate limiting. An attacker uses Burp Suite's Intruder tool with a 10,000-entry password list. What is this attack called and what is the primary mitigation?

Where this fits in the Web App Fundamentals exam

More free Authentication Basics questions

One question down. Thousands to go.