Which statement about a brute force attack is correct?

• A. A brute force attack guesses many password combinations until access is gained
• B. It relies on convincing users to reveal passwords
• C. It uses malware to steal data from a device
• D. It happens only with online accounts

Answer: (A)

Brute force attacks are about exhaustively trying a large number of possible passwords until one works. It’s a straightforward, automated process that tests many guesses in order to gain access, which is exactly what this statement describes. It isn’t about tricking people into revealing passwords, nor about malware stealing data. It also isn’t limited to online accounts—attackers can attempt guesses against a login portal or against stored password data offline by testing guesses against password hashes. So, describing brute force as guessing many password combinations until access is gained captures the core method of this attack.