A company's password policy currently requires passwords to be changed every 90 days and to be at least 10 characters long. The security team wants to reduce the risk of credential stuffing attacks. Which change would be most effective?

Require passwords to contain at least two special characters.

Implement a breach-checking service that blocks passwords found in known data breaches.

Increase the password length to 12 characters.

Reduce the password change interval to 30 days.

What is the primary advantage of a rainbow table attack over a traditional brute-force attack?

It is faster because it uses precomputed hash chains

It works without needing the password hash

It can crack passwords without any computational power

A company's security team discovers that a phishing campaign successfully harvested the Active Directory passwords of 40 employees. The team is relieved to find that no unauthorized access occurred. Which control already in place is most likely responsible for preventing the attackers from using the stolen passwords?

A password policy requiring 14-character complex passwords

Multi-factor authentication (MFA) enforced on all remote access and email systems

Regular password expiration every 60 days

A next-generation firewall with intrusion prevention enabled

Which password policy element is most effective at increasing resistance to brute-force attacks?

Requiring a minimum password length of 12 characters

Prohibiting the use of the username in the password

Requiring at least one special character

Requiring a password change every 30 days

Which characteristic is commonly associated with a strong password?

It is reused across multiple accounts

It is short and easy to remember

It is long and includes a mix of character types

It contains only lowercase letters

GIAC Certified Incident Handler

Domain 4Objective 2

Understanding Passwords GCIH Practice Questions (Page 5)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 21–25

21application · medium
A company's password policy currently requires passwords to be changed every 90 days and to be at least 10 characters long. The security team wants to reduce the risk of credential stuffing attacks. Which change would be most effective?
Select an answer first
22foundation · easy
What is the primary advantage of a rainbow table attack over a traditional brute-force attack?
Select an answer first
23application · medium
A company's security team discovers that a phishing campaign successfully harvested the Active Directory passwords of 40 employees. The team is relieved to find that no unauthorized access occurred. Which control already in place is most likely responsible for preventing the attackers from using the stolen passwords?
Select an answer first
24foundation · easy
Which password policy element is most effective at increasing resistance to brute-force attacks?
Select an answer first
25foundation · easy
Which characteristic is commonly associated with a strong password?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.