Credential Attacks GCIL Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic investigation reveals that a keylogger was installed on a user's workstation and captured the user's domain password as they typed it. The attacker then used that password to access the user's email. Which control would have most effectively prevented the attacker from using the captured password?

   • AEnforce multi-factor authentication for email access.
   • BRequire users to change their password every 30 days.
   • CUse a screen lock after 5 minutes of inactivity.
   • DDeploy an antivirus that detects keyloggers.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which component of an authentication system is most directly targeted by a credential attack?

   • AThe encryption algorithm
   • BThe user's credentials
   • CThe authentication factor
   • DThe network firewall
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is investigating a pass-the-hash attack. They find that the attacker used a hash from a local administrator account on a compromised workstation to access other workstations. The organization wants to prevent this lateral movement. Which control is most effective?

   • AMonitor for the use of the same hash from multiple hosts
   • BRequire complex passwords for local accounts
   • CUse unique local administrator passwords for each workstation
   • DDisable the local administrator account on all workstations
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's HR department received an email that appears to be from the CEO, asking for the recipient's login credentials to 'review a confidential document.' The email contains a link to a fake login page. Which control would be most effective in preventing the theft of credentials in this scenario?

   • ABlock the sender's email address in the email system.
   • BDeploy an email gateway that quarantines all external email.
   • CRequire users to hover over links to verify the URL before clicking.
   • DImplement multi-factor authentication on the corporate email and document management systems.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A domain administrator suspects that an attacker has stolen a Kerberos ticket-granting ticket (TGT) from a user's session and is using it to request service tickets for other resources. Which mitigation is most effective in limiting the impact of a stolen TGT?

   • AIncrease the password length for all service accounts.
   • BDisable NTLM authentication across the domain.
   • CRequire smart card authentication for all users.
   • DShorten the Kerberos ticket lifetime and enforce renewal intervals.
   Reveal Solution Discussion Select an answer first