A city login portal has no lockout. The tester must choose a password-attack approach that still respects careful RoE. Which judgment is soundest?
Select an answer to reveal the explanation.
Short Explanation
Spraying is like trying the same two keys on many locks; brute force is grinding one lock with every key you own. Even without lockout, the spray-style mindset keeps noise and account pain lower. Respect the RoE and pick the gentler pattern.
Full Explanation
On a city login portal without lockout, the soundest password-attack judgment under careful RoE is to prefer a spray-class approach—few candidate passwords across many users—over exhausting one account with dense attempts. Absence of lockout does not authorize unbounded per-account wordlists overnight against production; that pattern risks availability, account abuse signals, and citizen-facing outages. Disabling logging so spraying cannot be detected is active evasion against the city’s defensive visibility and is almost never within professional RoE. Skipping credential testing entirely whenever lockout is absent abandons a legitimate objective the engagement may explicitly include. Exam caveat: spray versus brute force is about attempt distribution and operational risk, not about which wordlist brand you prefer. Operational check: confirm rate limits and banned windows in the city RoE, log the chosen spray parameters, watch for service degradation on the portal, and stop immediately if availability or authentication pipelines show stress. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.