A developer is designing a new web application and wants to store user passwords securely. The application will run in a cloud environment and must comply with internal security standards. Which approach should the developer choose?

Use SHA-256 without a salt for speed and simplicity.

Use a password hashing algorithm such as bcrypt with a per-user salt.

Use AES encryption with a key stored in the application's source code.

Store passwords in a separate database table with restricted access.

A company is updating its password policy. The security team wants to balance security with usability. Which policy element is most effective at mitigating credential-stuffing attacks, where attackers use username/password pairs leaked from other sites?

Requiring a minimum password length of 16 characters

Setting password expiration to 30 days

Enforcing multi-factor authentication (MFA) for all user accounts

Implementing a password blacklist of common passwords

Which of the following is an example of a possession factor in multi-factor authentication?

A one-time code sent to a mobile device

In the context of authentication, what is the primary role of a password?

To provide a backup method for account recovery

To serve as a secret known only to the user to prove identity

To encrypt the user's data on the local device

To uniquely identify the user account in the system

A company has been the target of a credential-stuffing attack. The security team has implemented MFA for all users, but the attack continues. Analysis shows that the attacker is using valid credentials that have been obtained from a previous breach. Which additional control is most effective?

Implement a breach-checking service to block passwords that have appeared in known breaches.

Deploy an intrusion prevention system (IPS) to block the attacker's IP addresses.

Require users to change passwords every 30 days.

Increase the password length requirement to 15 characters.

GIAC Certified Incident Handler

Domain 4Objective 2

Understanding Passwords GCIH Practice Questions (Page 2)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 6–10

6application · medium
A developer is designing a new web application and wants to store user passwords securely. The application will run in a cloud environment and must comply with internal security standards. Which approach should the developer choose?
Select an answer first
7application · medium
A company is updating its password policy. The security team wants to balance security with usability. Which policy element is most effective at mitigating credential-stuffing attacks, where attackers use username/password pairs leaked from other sites?
Select an answer first
8foundation · easy
Which of the following is an example of a possession factor in multi-factor authentication?
Select an answer first
9foundation · easy
In the context of authentication, what is the primary role of a password?
Select an answer first
10expert · hard
A company has been the target of a credential-stuffing attack. The security team has implemented MFA for all users, but the attack continues. Analysis shows that the attacker is using valid credentials that have been obtained from a previous breach. Which additional control is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.