Credential and Password Attacks

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Credential and Password Attacks

Key Takeaways Explain This Topic AI

Credential attacks target authentication secrets, stored hashes, session tokens, identity providers, and user behavior rather than network capacity.

Brute force tries many passwords against one account; password spraying tries a few common passwords across many accounts to dodge lockout thresholds.

Credential stuffing replays valid username/password pairs harvested from an unrelated breach, so logins succeed from unusual sources.

Phishing, smishing, vishing, and MFA-fatigue/push-bombing attack the human, bypassing the strength of the stored password.

Mitigations include phishing-resistant MFA, salted adaptive hashing, lockout and rate limiting, conditional access, password managers, and credential rotation.

Last updated: June 2026

Distinguishing the Pattern

Authentication attacks look similar in raw logs, so the exam expects you to read the failure distribution and pick a mitigation that fits. The deciding question is usually "are many guesses hitting one account, or a few guesses spread across many accounts, or are valid credentials succeeding from a strange place?"

Attack Pattern Best clue Useful mitigations

Brute force Many guesses against one account or service High failed-attempt count for a single username Account lockout, rate limiting, MFA, block source IP

Password spraying One or few common passwords across many users Low failures per user, many usernames affected Detect horizontal failures, MFA, banned-password list

Credential stuffing Reused breached username/password pairs Successful logins from residential proxies or odd geos MFA, breached-password checks, anomaly/risk scoring

Dictionary attack Wordlist plus mutations Common words and leetspeak variants Strong policy, password manager, blocklists

Rainbow table Precomputed unsalted-hash lookup Stolen unsalted hashes cracked instantly Per-password salt, slow adaptive hashing

Phishing Deceptive message or cloned site User reports a link, fake login page captured Awareness, mail filtering, FIDO2/passkeys

MFA fatigue / push bombing Repeated push prompts until approval Many denied or ignored MFA pushes Number matching, push rate limits, phishing-resistant MFA

Shoulder surfing Observing secrets physically Public area, visible screen or keypad Privacy filters, clean-desk policy, training

Worked Log Example

• Event Users Failure pattern Likely attack
• 1,900 failed logins for "admin" in 4 minutes 1 Many guesses, one account Brute force
• 450 users each fail once with "Spring2026!" 450 One password, many accounts Password spraying

17 successful logins from residential proxies using real employee emails 17 Valid pairs, unusual source Credential stuffing

The mitigation must match the attack. An aggressive account lockout slows brute force but is a poor answer to spraying - it can lock out 450 real users and become a self-inflicted denial of service. When valid credentials succeed from a suspicious context (stuffing), the strongest answers are MFA and risk-based conditional access , because they break the value of a stolen password.

Credential Storage and Cracking

Hashing stores a one-way digest; a salt is a unique random value added before hashing so identical passwords produce different hashes, defeating rainbow tables. Key stretching (bcrypt, scrypt, PBKDF2, Argon2) deliberately slows hashing to make offline cracking expensive.

• Weakness Why it matters Better control
• Plaintext passwords Immediate disclosure if the database is stolen Never store plaintext

Fast unsalted hash (MD5, SHA-1) Trivial offline cracking and reuse lookup Salted adaptive hashing (Argon2/bcrypt)

• Shared admin password One compromise affects many systems Unique privileged credentials or PAM vaulting
• Hardcoded secret in code Leaks with the repo or container image Secrets manager and rotation
• Long-lived bearer token A stolen token stays useful for weeks Short lifetime, scope limits, revocation
• Social Engineering Forms

• Form Channel Note
• Phishing Email / web Broad, untargeted
• Smishing SMS text Mobile-focused
• Vishing Voice call Often impersonates IT or a bank
• Spear phishing Targeted email Tailored to a specific person
• Whaling Targeted email Aimed at senior executives
• Pretexting Any Invented backstory to build trust
• Common Traps

Trap Correct reasoning

Treat every login-failure spike as brute force Check whether failures concentrate on one account or spread across many

Rotate only the visible user's password after malware Tokens, browser sessions, API keys, and service accounts may also be exposed

Rely on SMS MFA for high-risk admin access SIM-swap and SS7 attacks make SMS weak; prefer FIDO2/number matching

• Store recovery codes in the mailbox they protect Protect recovery material separately and offline
• Token, Session, and Identity-Provider Abuse

Modern credential attacks increasingly skip the password entirely and target the session . After a user authenticates, the system issues a token or cookie; stealing that artifact lets an attacker ride the session without ever knowing the password - and without tripping MFA, because MFA already happened at login.

Abuse How it works Mitigation

Session hijacking Stolen session cookie reused by attacker Bind sessions to context, rotate on privilege change, HttpOnly/Secure cookies

Pass-the-hash Reuse an NTLM hash without cracking it Credential Guard, restrict admin reuse, unique local admin passwords

Pass-the-ticket / Golden Ticket Forge or replay Kerberos tickets Protect the KRBTGT account, limit Domain Admin exposure

OAuth/token theft Steal a bearer token from storage or logs Short token lifetime, scope limits, revocation on anomaly

Directory traversal of secrets Read a secrets file via app flaw Secrets manager, least privilege, path validation

The exam lesson: after a credential compromise, resetting the visible password is necessary but not sufficient - active sessions, refresh tokens, API keys, and service-account secrets must also be revoked and rotated, or the attacker simply keeps the session they already hold.

Quick Drill

(1) One executive gets a fake DocuSign email to a cloned login page - spear phishing; filter, train, and require phishing-resistant MFA. (2) Hundreds of accounts each fail once with "Password1!" - password spraying; detect horizontal attempts and enforce MFA. (3) A leaked database of unsalted MD5 hashes - rainbow-table/offline cracking risk; migrate to salted adaptive hashing and force resets. (4) An attacker reuses a stolen session cookie and bypasses MFA - session hijacking; rotate and bind sessions, then revoke the token.