Credential Attacks GCIL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization wants to defend against dictionary attacks on its VPN. The VPN uses username/password authentication. Which control is most effective?

   • ADisable the VPN after business hours
   • BRestrict VPN access to specific IP addresses
   • CImplement multi-factor authentication
   • DUse a longer password policy
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the most effective control to mitigate credential phishing?

   • AChanging passwords every 30 days
   • BUsing a password manager
   • CBlocking all external emails
   • DUsing multi-factor authentication (MFA)
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company recently discovered that a large set of username/password pairs from a third-party breach is being used to log into employee accounts on the corporate VPN. The security team wants to reduce the risk of these compromised credentials being used successfully while minimizing disruption to the workforce. Which combination of controls should be implemented first?

   • AImplement a password manager and require unique passwords for every service.
   • BEnforce multi-factor authentication on the VPN and block the known breached password list from being used.
   • CDisable VPN access for all accounts that appear in the breach until each user is re-verified.
   • DRequire all employees to change their passwords immediately and increase the minimum password length to 14 characters.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a best practice to defend against credential attacks?

   • ADisabling password complexity requirements
   • BEnabling multi-factor authentication (MFA)
   • CUsing the same password for all accounts
   • DSharing passwords among team members
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company has a mature security awareness program, but users still occasionally fall for phishing emails that steal their credentials. The security team wants to implement a control that reduces the impact of these successful phishes without requiring users to change their behavior. Which control is most effective?

   • ADeploy a web proxy that blocks known phishing domains.
   • BBlock all email from external domains.
   • CIncrease the frequency of phishing simulations.
   • DEnforce multi-factor authentication on all remote access and email systems.
   Reveal Solution Discussion Select an answer first