A security analyst is reviewing authentication logs and notices a pattern: a single username has multiple failed login attempts, each with a different password, originating from a single IP address. The attempts are spread over several hours, with 2-3 attempts per hour. The account is not locked out. What is the most likely attack, and what is the best immediate response?

Brute-force attack; immediately disable the account to stop the attack

Brute-force attack; implement rate limiting and alert on further attempts

Password spraying attack; block the source IP address

Credential stuffing attack; reset the user's password

A company has just experienced a brute-force attack against its VPN. The VPN uses only username/password authentication. The security team must choose a mitigation that balances security with user productivity. The company has a mix of employees using company-managed laptops and personal devices. Which mitigation is the best balance?

Enforce MFA using a mobile authenticator app for all VPN users.

Implement account lockout after three failed attempts.

Restrict VPN access to company-managed devices only.

Require a complex password of at least 16 characters for all VPN users.

A security auditor is reviewing an organization's password storage. The auditor finds that passwords are stored using a salted hash, but the salt is derived from the username. What is the primary security concern with this approach?

The salt is too short, making it vulnerable to collision attacks.

The salt is not random, so two users with the same password will have the same hash.

The salt is not kept secret, so an attacker can remove it.

The salt is predictable, allowing an attacker to precompute a rainbow table for that specific salt.

A company is implementing MFA for its remote workforce. The security team is considering using push notifications to a mobile app as the second factor. What is a primary security advantage of push-based MFA over SMS-based OTP?

Push notifications are faster and more convenient for users

Push notifications are not vulnerable to phishing attacks

Push notifications do not rely on the cellular network, reducing the risk of SIM-swapping attacks

Push notifications are automatically encrypted end-to-end

Which defensive measure is most effective at mitigating credential stuffing attacks?

Encrypting passwords in transit with TLS

Disabling password autofill in browsers

Requiring multi-factor authentication (MFA)

GIAC Certified Incident Handler

Domain 4Objective 2

Understanding Passwords GCIH Practice Questions (Page 3)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 11–15

11expert · hard
A security analyst is reviewing authentication logs and notices a pattern: a single username has multiple failed login attempts, each with a different password, originating from a single IP address. The attempts are spread over several hours, with 2-3 attempts per hour. The account is not locked out. What is the most likely attack, and what is the best immediate response?
Select an answer first
12expert · hard
A company has just experienced a brute-force attack against its VPN. The VPN uses only username/password authentication. The security team must choose a mitigation that balances security with user productivity. The company has a mix of employees using company-managed laptops and personal devices. Which mitigation is the best balance?
Select an answer first
13expert · hard
A security auditor is reviewing an organization's password storage. The auditor finds that passwords are stored using a salted hash, but the salt is derived from the username. What is the primary security concern with this approach?
Select an answer first
14application · medium
A company is implementing MFA for its remote workforce. The security team is considering using push notifications to a mobile app as the second factor. What is a primary security advantage of push-based MFA over SMS-based OTP?
Select an answer first
15foundation · easy
Which defensive measure is most effective at mitigating credential stuffing attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Understanding Passwords GCIH Practice Questions (Page 3)

Questions 11–15

A security auditor is reviewing an organization's password storage. The auditor finds that passwords are stored using a salted hash, but the salt is derived from the username. What is the primary security concern with this approach?

A company is implementing MFA for its remote workforce. The security team is considering using push notifications to a mobile app as the second factor. What is a primary security advantage of push-based MFA over SMS-based OTP?

Which defensive measure is most effective at mitigating credential stuffing attacks?

Keep studying — Credential and Access Security