Which scenario best describes an offline password attack?

An attacker uses a phishing email to trick a user into revealing their password

An attacker uses a password spraying tool against an organization's VPN

An attacker tries common passwords against a web login form

An attacker captures password hashes and attempts to crack them on their own machine

A company has experienced a credential stuffing attack. Which post-incident measure would be most effective in preventing future credential stuffing attacks?

Implement MFA and monitor for logins from unusual locations

Increase the password complexity requirements

Block all traffic from countries where the attack originated

Require users to change passwords every 90 days

An incident responder has two tasks: crack a set of captured NTLM hashes and test the organization's web application login for weak passwords. The responder wants to avoid detection and account lockouts. Which approach BEST balances effectiveness and stealth?

Use credential stuffing on the web app and crack hashes with brute force

Crack the hashes offline and perform a password spraying test on the web app

Perform a brute force attack on the web app and crack hashes online

Use a dictionary attack on the web app and crack hashes with a hybrid attack

A company wants to reduce the risk of credential stuffing attacks against its web application. Which control is most effective at directly mitigating this specific attack?

Increase the minimum password length to 20 characters

Enforce multi-factor authentication (MFA) for all user accounts

Disable account lockout after failed attempts

Require users to change passwords every 30 days

In a pass-the-hash attack, what does the attacker use to authenticate to a remote system?

A Kerberos ticket-granting ticket

A digital certificate issued by a certificate authority

The NTLM or LM hash of the user's password

The plaintext password of the user

GIAC Certified Incident Handler

Domain 4Objective 1

Attacking Passwords GCIH Practice Questions (Page 7)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
Which scenario best describes an offline password attack?
Select an answer first
32application · medium
A company has experienced a credential stuffing attack. Which post-incident measure would be most effective in preventing future credential stuffing attacks?
Select an answer first
33expert · hard
An incident responder has two tasks: crack a set of captured NTLM hashes and test the organization's web application login for weak passwords. The responder wants to avoid detection and account lockouts. Which approach BEST balances effectiveness and stealth?
Select an answer first
34application · medium
A company wants to reduce the risk of credential stuffing attacks against its web application. Which control is most effective at directly mitigating this specific attack?
Select an answer first
35foundation · easy
In a pass-the-hash attack, what does the attacker use to authenticate to a remote system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.