Credential Attacks GCIL Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is evaluating controls to reduce the risk of credential stuffing and password spraying against their customer-facing web application. The application is used by a large number of customers, and the team wants to avoid locking out legitimate users. Which approach is most effective?

   • ABlock all traffic from data centers and VPN providers.
   • BRequire all customers to change their passwords every 60 days.
   • CLock accounts after three failed login attempts.
   • DImplement risk-based authentication that challenges suspicious logins with MFA or CAPTCHA.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A user reports that their bank account was accessed from a foreign IP address. An investigation shows that the user's computer had a keylogger that captured the bank's login credentials. Which defense would have been most effective in preventing the attacker from using the captured credentials?

   • AUse a virtual keyboard for entering the password.
   • BChange the bank password every month.
   • CUse multi-factor authentication for the bank account.
   • DInstall an antivirus program on the user's computer.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is planning a defense-in-depth strategy against credential attacks. They have limited budget and must choose between two controls: implementing MFA for all users or deploying a SIEM to monitor authentication logs. Which approach is most effective?

   • ASpend the budget on user awareness training only
   • BImplement MFA first, then use remaining budget for SIEM
   • CDeploy SIEM first, then use remaining budget for MFA
   • DUse the budget to increase password length requirements
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst notices a high volume of failed login attempts against the company's web application. The attempts use a list of common passwords (e.g., 'Password123', 'Summer2024') but each attempt uses a different username. The analyst wants to block this activity without locking out legitimate users. Which action is most appropriate?

   • ARequire all users to change their passwords immediately.
   • BImplement account lockout after five failed attempts per username.
   • CBlock all traffic from the IP addresses that generated the failed attempts.
   • DEnable rate limiting per source IP and add a CAPTCHA after multiple failed attempts from the same IP.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company's security team is investigating a breach where an attacker used a keylogger to capture a user's password and then accessed the user's corporate email. The team wants to implement a control that would prevent this from happening again, but the company has a policy that prohibits the use of MFA for email access due to cost. Which control is most effective under this constraint?

   • AImplement a host-based firewall to block outbound connections.
   • BRequire users to change their passwords every 30 days.
   • CDeploy endpoint detection and response (EDR) software on all workstations.
   • DUse a password manager that auto-fills credentials.
   Reveal Solution Discussion Select an answer first