Option D is the correct answer because a brute force attack refers to a process in which attackers systematically guess passwords or encryption keys until they obtain valid access. CHFI v11 explicitly includes Investigating Brute Force Attack as part of its network and web attack objectives, making this a core concept candidates are expected to recognize.
This differs from social engineering, parameter manipulation, or exploitation of technical vulnerabilities. The defining feature of brute force is repeated trial-and-error authentication attempts , often automated, using many possible password combinations or key values. In online banking scenarios, this can manifest as repeated login attempts against customer accounts, frequently from the same source or through distributed infrastructure.
Option A describes interface manipulation, B is social engineering, and C is exploitation of vulnerabilities more generally. None of those captures the essential meaning of brute force. Therefore, under CHFI's attack- investigation framework, the most accurate interpretation is that attackers are systematically guessing credentials or keys to gain unauthorized access .