GIAC Certified Incident Handler
Domain 4Objective 1
Attacking Passwords GCIH Practice Questions (Page 8)
Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)
41questions here
9free pages
8concepts
Questions 36–40
- 36
A security analyst is tasked with testing the strength of the organization's password hashes. The analyst has a list of common passwords and wants to crack hashes that are simple dictionary words. Which cracking technique would be the FASTEST for this specific task?
Select an answer first - 37
During a penetration test, a tester gains access to a Windows machine and extracts NTLM hashes. The tester then uses these hashes to authenticate to other machines on the network without knowing the plaintext passwords. Which attack is the tester performing?
Select an answer first - 38
A Windows domain administrator wants to reduce the risk of pass-the-hash attacks. Which configuration change is most effective?
Select an answer first - 39
A company wants to reduce the risk of password spraying and credential stuffing without causing significant user friction. They currently use only passwords for authentication. Which control would be MOST effective while balancing user experience?
Select an answer first - 40
An incident responder is investigating a Windows domain where an attacker gained access to a workstation and then moved laterally to a file server without ever entering a plaintext password. The responder finds that the attacker used a tool to inject a captured NTLM hash into memory on the file server. Which attack technique does this describe?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.