A security team is investigating a suspected pass-the-ticket attack. They have two hypotheses: (1) an attacker stole a TGT from a domain controller, or (2) an attacker stole a service ticket from a compromised workstation. Which evidence would most strongly differentiate between these two scenarios?

The TGT was used to request service tickets for multiple resources, while the service ticket was used only for a single service

The attacker used the ticket during the ticket's validity period

The attacker did not know the user's plaintext password

The attacker used the ticket from a different workstation than the original user

A forensic analyst captured a memory dump from a compromised server and extracted password hashes. The analyst plans to crack these hashes offline using a GPU cluster. Which statement BEST describes why this is considered an offline attack?

The attack must be performed during off-peak hours

The attack requires physical access to the target server

The attack uses only previously breached password lists

The cracking process does not interact with the live target system

Why do attackers prefer password spraying over traditional brute force attacks when targeting an organization with account lockout policies?

It reduces the risk of triggering account lockouts

It uses faster hardware to crack hashes offline

It guarantees success on the first attempt

It bypasses the need for any password at all

An attacker compromised a domain controller and extracted Kerberos ticket-granting tickets (TGTs) from memory. The attacker then used these TGTs to impersonate domain users and access resources without knowing their passwords. Which control would be MOST effective in limiting the impact of this type of attack?

Frequent rotation of the krbtgt account password

Enforcing strong password policies for all users

Implementing account lockout policies

What is the primary reason credential stuffing attacks are often successful?

Multi-factor authentication is rarely available

Users frequently reuse the same password across multiple accounts

Attackers have unlimited computing power

Passwords are stored in plaintext on most systems

GIAC Certified Incident Handler

Domain 4Objective 1

Attacking Passwords GCIH Practice Questions (Page 6)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

Questions 26–30

26expert · hard
A security team is investigating a suspected pass-the-ticket attack. They have two hypotheses: (1) an attacker stole a TGT from a domain controller, or (2) an attacker stole a service ticket from a compromised workstation. Which evidence would most strongly differentiate between these two scenarios?
Select an answer first
27application · medium
A forensic analyst captured a memory dump from a compromised server and extracted password hashes. The analyst plans to crack these hashes offline using a GPU cluster. Which statement BEST describes why this is considered an offline attack?
Select an answer first
28foundation · easy
Why do attackers prefer password spraying over traditional brute force attacks when targeting an organization with account lockout policies?
Select an answer first
29expert · hard
An attacker compromised a domain controller and extracted Kerberos ticket-granting tickets (TGTs) from memory. The attacker then used these TGTs to impersonate domain users and access resources without knowing their passwords. Which control would be MOST effective in limiting the impact of this type of attack?
Select an answer first
30foundation · easy
What is the primary reason credential stuffing attacks are often successful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Attacking Passwords GCIH Practice Questions (Page 6)

Questions 26–30

A forensic analyst captured a memory dump from a compromised server and extracted password hashes. The analyst plans to crack these hashes offline using a GPU cluster. Which statement BEST describes why this is considered an offline attack?

Why do attackers prefer password spraying over traditional brute force attacks when targeting an organization with account lockout policies?

What is the primary reason credential stuffing attacks are often successful?

Keep studying — Credential and Access Security