Credential stuffing involves what?

• A. Using breached credentials to attempt access on other sites where those credentials might work.
• B. Creating new user accounts with brute force.
• C. Encrypting credentials in transit.
• D. Storing credentials in a database.

Answer: (A)

Credential stuffing centers on credential reuse. Attackers take username/password pairs from data breaches and test them on many different sites to see if the same credentials still grant access. If a user reused the same credentials, the attacker can break into those other accounts, often automatically and at scale. That matches the described action: using breached credentials to try access on other sites where they might still work.

The other options describe different activities: creating new accounts with brute force targets account creation itself rather than reusing known pairs; encrypting credentials in transit is about protecting data during transmission; storing credentials in a database is about how credentials are held, not about exploiting them.