Which of the following is listed as a means Bob can adopt to retrieve passwords from client hosts and servers?

• A. Hardware, Software, and Sniffing
• B. Phishing
• C. Brute force
• D. Social engineering

Answer: (A)

Retrieving passwords from client hosts and servers can be done by intercepting credentials at the source or while they move across the network. The method that combines hardware, software, and sniffing is the best fit because it covers both on-device capture and network-based capture. Hardware methods involve physical devices like keyloggers plugged between the keyboard and the computer, which record keystrokes as passwords are typed. Software methods use programs running on the host to log keystrokes or extract stored credentials. Sniffing involves capturing traffic on a network so credentials transmitted in cleartext or weakly protected protocols can be read, especially when an attacker positions themselves in a man-in-the-middle or uses insecure services.

Phishing and social engineering rely on tricking users to reveal credentials rather than directly pulling them from the machines or during transit, and brute force guesses passwords by attempting many combinations. While those techniques can lead to obtaining passwords, they do not describe the direct capture of passwords from the hosts and servers like hardware, software keyloggers, and network sniffing do.