What is a brute-force attack?

• A. An attack where predefined values are used to guess a password incrementally until the correct one is found.
• B. An attack that floods a server with traffic to exhaust resources.
• C. An attack that uses social engineering to bypass authentication.
• D. An attack that decrypts data without the key.

Answer: (A)

Brute-force is an exhaustive guessing method where every possible credential in the search space is tried until the correct one is found. It relies on the attacker systematically testing many candidates, often starting with simpler patterns or common passwords and then increasing complexity until a match occurs. The idea is not to exploit a weakness in the system, but to outwait the defender by brute force through the password space with enough time and compute power.

This distinguishes brute-force from other attacks described here. Flooding a server with traffic is a DoS/DDoS attack aimed at exhausting resources rather than guessing a password. Social engineering tries to bypass authentication by manipulating people rather than cracking the credential. Decrypting data without the key can involve cryptanalysis, which targets the cryptographic algorithm itself rather than simply guessing a password.

In practice, brute-force can be mitigated by rate limiting, account lockouts, strong password requirements, and proper password hashing with salts to make each guess more expensive.