An organization wants to encourage employees to use unique, complex passwords for each service without requiring them to memorize dozens of passwords. Which solution best meets this need?

Require users to use a passphrase that is easy to remember but long, such as 'correct horse battery staple'.

Implement a single sign-on system that uses one master password for all applications.

Create a spreadsheet with all passwords and store it on an encrypted network share.

Deploy an enterprise password manager that integrates with the organization's SSO and directory services.

A small business wants to improve password security without deploying complex infrastructure. Employees currently reuse the same password across multiple sites. Which solution is the most practical first step?

Implement a company-wide policy that requires a different password for every site and post it on the intranet.

Use a browser extension that automatically fills in passwords from a shared spreadsheet.

Enforce a minimum password length of 8 characters and require a special character.

Deploy a password manager for all employees and require its use for work-related accounts.

A company is deploying a password manager. The security team is concerned about the master password being the single point of failure. They want to implement a solution that reduces the risk of master password compromise while maintaining usability. Which approach is most effective?

Use a passphrase that is easy to remember and change it every 30 days

Implement MFA on the password manager and use a hardware token for the master password

Store the master password in a shared document for recovery purposes

Require a very long master password (20+ characters) and do not allow password resets

GIAC Certified Incident Handler

Domain 4Objective 2

Understanding Passwords GCIH Practice Questions (Page 8)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 36–39

36application · medium
An organization wants to encourage employees to use unique, complex passwords for each service without requiring them to memorize dozens of passwords. Which solution best meets this need?
Select an answer first
37application · medium
A small business wants to improve password security without deploying complex infrastructure. Employees currently reuse the same password across multiple sites. Which solution is the most practical first step?
Select an answer first
38foundation · easy
Which password cracking technique involves trying every possible combination of characters until the correct password is found?
Select an answer first
39expert · hard
A company is deploying a password manager. The security team is concerned about the master password being the single point of failure. They want to implement a solution that reduces the risk of master password compromise while maintaining usability. Which approach is most effective?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Understanding Passwords GCIH Practice Questions (Page 8)

Questions 36–39

An organization wants to encourage employees to use unique, complex passwords for each service without requiring them to memorize dozens of passwords. Which solution best meets this need?

A small business wants to improve password security without deploying complex infrastructure. Employees currently reuse the same password across multiple sites. Which solution is the most practical first step?

Which password cracking technique involves trying every possible combination of characters until the correct password is found?

A company is deploying a password manager. The security team is concerned about the master password being the single point of failure. They want to implement a solution that reduces the risk of master password compromise while maintaining usability. Which approach is most effective?

Keep studying — Credential and Access Security