Which statement best defines a brute-force attack?

• A. An attack that uses predefined values to guess a password incrementally until the correct one is found.
• B. An attack that cracks hashes using rainbow tables only.
• C. An attack that discovers passwords by exploiting software vulnerabilities.
• D. An attack that redirects network traffic to a malicious host.

Answer: (A)

Brute-force attacks rely on an exhaustive search: systematically trying every possible password until the correct one is found. The statement describes using a set of predefined candidate values and testing them in sequence until success, which matches this idea of an exhaustive, step-by-step guess process. In practice, you might start with common or simple values and progressively try longer or more complex combinations, continuing until the right password is discovered.

This differs from rainbow table attacks, which use precomputed hash-to-password mappings to reverse a hash, rather than trying every possible value. It also doesn't describe exploiting software flaws or redirecting traffic, which are unrelated methods of gaining access.