What is the primary goal of a credential attack?

To encrypt the victim's files and demand a ransom

To overwhelm a service with traffic to cause denial of service

To intercept and modify network traffic in transit

To gain unauthorized access by obtaining or bypassing authentication credentials

An organization uses Kerberos for authentication. A security analyst discovers that an attacker is using stolen Kerberos tickets to access resources. The tickets were obtained from a compromised domain controller. Which control would be most effective in limiting the impact?

Reset the krbtgt account password twice

Increase the password complexity for service accounts

Shorten Kerberos ticket lifetimes

A user receives a phone call from someone claiming to be from the IT help desk, asking for their password to 'verify their account'. The user provides it. Which control would have prevented this?

User awareness training on social engineering

A company discovers that a keylogger was installed on a user's laptop and captured the user's password for a critical application. The user had already changed their password after the infection was detected. Which additional control would best protect against the keylogger capturing the new password?

Change the password again after 30 days

Use a password manager with auto-fill

GIAC Cyber Incident Leader

Domain 1Objective 2

Credential Attacks GCIL Practice Questions (Page 10)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 46–50

46foundation · easy
What is the primary goal of a credential attack?
Select an answer first
47expert · hard
An organization uses Kerberos for authentication. A security analyst discovers that an attacker is using stolen Kerberos tickets to access resources. The tickets were obtained from a compromised domain controller. Which control would be most effective in limiting the impact?
Select an answer first
48application · medium
A user receives a phone call from someone claiming to be from the IT help desk, asking for their password to 'verify their account'. The user provides it. Which control would have prevented this?
Select an answer first
49application · medium
A company discovers that a keylogger was installed on a user's laptop and captured the user's password for a critical application. The user had already changed their password after the infection was detected. Which additional control would best protect against the keylogger capturing the new password?
Select an answer first
50foundation · easy
Which authentication protocol is most commonly associated with pass-the-hash attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Credential Attacks GCIL Practice Questions (Page 10)

Questions 46–50

What is the primary goal of a credential attack?

An organization uses Kerberos for authentication. A security analyst discovers that an attacker is using stolen Kerberos tickets to access resources. The tickets were obtained from a compromised domain controller. Which control would be most effective in limiting the impact?

A user receives a phone call from someone claiming to be from the IT help desk, asking for their password to 'verify their account'. The user provides it. Which control would have prevented this?

Which authentication protocol is most commonly associated with pass-the-hash attacks?

Keep studying — Attack Types and Vectors