A company wants to reduce the risk of credential stuffing attacks without causing significant user friction. Which combination of controls is most effective?

CAPTCHA on every login and IP blocking

Single sign-on and disabling multi-factor authentication

Password expiration every 30 days and complexity requirements

Multi-factor authentication and monitoring for impossible travel

A security team discovers that an attacker used a password that was leaked from a personal online shopping site to log into a corporate cloud application. The user had used the same password for both accounts. Which mitigation would most directly address this specific risk?

Require users to change their passwords every 90 days.

Implement a policy that blocks the use of passwords found in known breach databases.

Enable single sign-on (SSO) for the cloud application.

Deploy a web application firewall (WAF) in front of the cloud application.

What is the purpose of a Kerberos Ticket-Granting Ticket (TGT)?

To authenticate the user to the Key Distribution Center (KDC)

To provide a one-time password for each login

To store the user's password hash for later verification

To encrypt all network traffic between the user and the server

Which defense is most effective at preventing keyloggers from capturing credentials?

Using multi-factor authentication

A company discovers that several employee accounts were accessed using credentials that were leaked in a data breach at a different company. The security team wants to identify which accounts are at risk. Which action is most effective?

Monitor login attempts for unusual patterns

Compare the breached credential list against current user accounts

Reset all passwords immediately

GIAC Cyber Incident Leader

Domain 1Objective 2

Credential Attacks GCIL Practice Questions (Page 3)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 11–15

11application · medium
A company wants to reduce the risk of credential stuffing attacks without causing significant user friction. Which combination of controls is most effective?
Select an answer first
12application · medium
A security team discovers that an attacker used a password that was leaked from a personal online shopping site to log into a corporate cloud application. The user had used the same password for both accounts. Which mitigation would most directly address this specific risk?
Select an answer first
13foundation · easy
What is the purpose of a Kerberos Ticket-Granting Ticket (TGT)?
Select an answer first
14foundation · easy
Which defense is most effective at preventing keyloggers from capturing credentials?
Select an answer first
15application · medium
A company discovers that several employee accounts were accessed using credentials that were leaked in a data breach at a different company. The security team wants to identify which accounts are at risk. Which action is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.