A security analyst is reviewing authentication logs and notices that a single IP address has attempted to log in with the same password ('Spring2024!') against 1,000 different user accounts over the past hour. No account has been locked out because the lockout threshold is 5 attempts. Which attack is this, and what is the most effective immediate response?

Credential stuffing; reset all passwords and require users to change them

Password spraying; block the IP address and enforce MFA for all accounts

Pass-the-hash; disable NTLM authentication

Brute force; increase the account lockout threshold to 10 attempts

A security team is comparing pass-the-hash and pass-the-ticket attacks to determine which is more likely in their environment. The environment uses Kerberos as the primary authentication protocol, but NTLM is enabled for legacy applications. Which statement is most accurate?

Both attacks are equally likely regardless of protocol usage

Pass-the-hash is more likely because NTLM is enabled

Pass-the-ticket is more likely because Kerberos is the primary protocol, but pass-the-hash remains possible where NTLM is used

Neither attack is possible if MFA is enabled

A company has a large user base and wants to implement a control that reduces the risk of credential stuffing without requiring users to change their passwords. Which control is most effective?

Require users to use a password manager to generate unique passwords

Implement a CAPTCHA on the login page

Monitor for logins from unusual IP addresses

Implement MFA using a mobile authenticator app

A domain administrator is investigating a potential pass-the-ticket attack. Which monitoring activity would provide the most direct evidence of this attack?

Monitor for multiple failed login attempts from a single IP address

Monitor for changes to password policy

Monitor for unusual Kerberos ticket requests, such as TGTs being used from unexpected workstations

Monitor for large file transfers to external IP addresses

GIAC Certified Incident Handler

Domain 4Objective 1

Attacking Passwords GCIH Practice Questions (Page 2)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

Questions 6–10

6expert · hard
A security analyst is reviewing authentication logs and notices that a single IP address has attempted to log in with the same password ('Spring2024!') against 1,000 different user accounts over the past hour. No account has been locked out because the lockout threshold is 5 attempts. Which attack is this, and what is the most effective immediate response?
Select an answer first
7expert · hard
A security team is comparing pass-the-hash and pass-the-ticket attacks to determine which is more likely in their environment. The environment uses Kerberos as the primary authentication protocol, but NTLM is enabled for legacy applications. Which statement is most accurate?
Select an answer first
8foundation · easy
What does a pass-the-ticket attack use to impersonate a user in a domain?
Select an answer first
9expert · hard
A company has a large user base and wants to implement a control that reduces the risk of credential stuffing without requiring users to change their passwords. Which control is most effective?
Select an answer first
10application · medium
A domain administrator is investigating a potential pass-the-ticket attack. Which monitoring activity would provide the most direct evidence of this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Attacking Passwords GCIH Practice Questions (Page 2)

Questions 6–10

A security team is comparing pass-the-hash and pass-the-ticket attacks to determine which is more likely in their environment. The environment uses Kerberos as the primary authentication protocol, but NTLM is enabled for legacy applications. Which statement is most accurate?

What does a pass-the-ticket attack use to impersonate a user in a domain?

A company has a large user base and wants to implement a control that reduces the risk of credential stuffing without requiring users to change their passwords. Which control is most effective?

A domain administrator is investigating a potential pass-the-ticket attack. Which monitoring activity would provide the most direct evidence of this attack?

Keep studying — Credential and Access Security