Name and describe two common password attacks and mitigations.

• A. Phishing and credential stuffing; mitigations include user education and MFA.
• B. Brute-force attack and dictionary attack; mitigations include rate limiting, MFA, strong passwords, salted hashes, and account monitoring.
• C. SQL injection and cross-site scripting; mitigations include input validation and escaping.
• D. Denial of service and man-in-the-middle; mitigations include traffic filtering.

Answer: (B)

Two common password attacks are brute-force and dictionary attacks. A brute-force attack systematically tests every possible password combination until it finds one that works, which is why defenses aim to slow or block repeated login attempts. A dictionary attack uses a precompiled list of common passwords and words to guess credentials, often faster because it targets likely choices rather than all possible combinations. To mitigate both, implement rate limiting on login attempts and monitor for unusual activity; require multi-factor authentication so access isn’t granted with just a password; enforce strong, long passwords to enlarge the search space; store passwords with salted hashes so stolen credential databases aren’t easily cracked with precomputed tables; and set up account monitoring to detect and respond to repeated failures or anomalies. Other options describe different kinds of attacks or defenses that aren’t primarily about guessing passwords, so they don’t fit as well.