Why is credential stuffing often successful even when a website has strong password requirements?

Because users reuse the same credentials across multiple sites

Because the website's password policy is not enforced

Because the website does not use encryption

Because strong passwords are easier to guess

A company has a large number of customer accounts and has experienced credential stuffing attacks using passwords leaked from other sites. The security team wants to reduce the risk without requiring all customers to change their passwords. Which control is most effective?

Deploy a web application firewall (WAF) to block known attack patterns.

Require customers to change their passwords every 30 days.

Implement multi-factor authentication for all customer accounts.

Block all traffic from countries where the attacks originate.

A security architect is designing a defense against pass-the-hash and pass-the-ticket attacks in a Windows environment. The organization has many legacy applications that require NTLM, so completely disabling NTLM is not feasible. Which approach provides the best balance of security and operational compatibility?

Increase the password length for all service accounts.

Restrict NTLM to specific legacy servers, enable Kerberos for everything else, and use privileged access workstations for admins.

Implement a SIEM to detect pass-the-hash and pass-the-ticket activity.

Disable NTLM everywhere and force all applications to use Kerberos.

A security analyst observes that an attacker who compromised a low-privileged workstation is now authenticating to multiple servers using a captured NTLM hash of a domain admin. The organization has a mature SIEM and wants to detect this activity without disrupting legitimate authentication. Which detection strategy is most effective?

Monitor for the use of the same NTLM hash from multiple source hosts

Alert on any successful login by a domain admin

Disable NTLM authentication across the domain

Require smart card authentication for all admin accounts

A company's security team finds that an attacker used a list of username/password pairs from a previous breach of a different company to log into the company's SaaS applications. The team wants to reduce the risk of this happening again. Which control is most directly effective?

Increase the password complexity requirements for all users.

Enable multi-factor authentication on all SaaS applications.

Deploy a network-based intrusion detection system (IDS).

Require users to change their passwords every 60 days.

GIAC Cyber Incident Leader

Domain 1Objective 2

Credential Attacks GCIL Practice Questions (Page 11)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 51–55

51foundation · easy
Why is credential stuffing often successful even when a website has strong password requirements?
Select an answer first
52expert · hard
A company has a large number of customer accounts and has experienced credential stuffing attacks using passwords leaked from other sites. The security team wants to reduce the risk without requiring all customers to change their passwords. Which control is most effective?
Select an answer first
53expert · hard
A security architect is designing a defense against pass-the-hash and pass-the-ticket attacks in a Windows environment. The organization has many legacy applications that require NTLM, so completely disabling NTLM is not feasible. Which approach provides the best balance of security and operational compatibility?
Select an answer first
54expert · hard
A security analyst observes that an attacker who compromised a low-privileged workstation is now authenticating to multiple servers using a captured NTLM hash of a domain admin. The organization has a mature SIEM and wants to detect this activity without disrupting legitimate authentication. Which detection strategy is most effective?
Select an answer first
55application · medium
A company's security team finds that an attacker used a list of username/password pairs from a previous breach of a different company to log into the company's SaaS applications. The team wants to reduce the risk of this happening again. Which control is most directly effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Credential Attacks GCIL Practice Questions (Page 11)

Questions 51–55

Why is credential stuffing often successful even when a website has strong password requirements?

A company has a large number of customer accounts and has experienced credential stuffing attacks using passwords leaked from other sites. The security team wants to reduce the risk without requiring all customers to change their passwords. Which control is most effective?

A company's security team finds that an attacker used a list of username/password pairs from a previous breach of a different company to log into the company's SaaS applications. The team wants to reduce the risk of this happening again. Which control is most directly effective?

Keep studying — Attack Types and Vectors