A user receives an email that appears to be from the company's IT department, asking them to verify their password by clicking a link. The link leads to a fake login page. The user enters their credentials and later reports the incident. Which immediate action should the security team take?

Disable the user's account permanently

Block the sender's email address

Force a password reset for the affected user

Ignore the incident because the user did not submit the form

A company wants to reduce the risk of credential reuse across multiple systems. Which policy is most effective?

Require users to change passwords every 90 days

Implement account lockout after 5 failed attempts

Use a single strong password for all systems

Use a password manager to generate unique passwords for each system

What is the primary function of a keylogger?

To record keystrokes made by a user

To encrypt files on the victim's computer

To scan the network for open ports

A company's web application is being targeted by a brute-force attack. The security team wants to slow down the attack without affecting legitimate users who occasionally mistype their passwords. Which control is most appropriate?

Implement progressive delays after multiple failed attempts from the same IP address.

Lock the account after one failed attempt.

Require users to reset their password after any failed attempt.

Block the IP address after two failed attempts.

GIAC Cyber Incident Leader

Domain 1Objective 2

Credential Attacks GCIL Practice Questions (Page 7)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 31–35

31application · medium
A user receives an email that appears to be from the company's IT department, asking them to verify their password by clicking a link. The link leads to a fake login page. The user enters their credentials and later reports the incident. Which immediate action should the security team take?
Select an answer first
32application · medium
A company wants to reduce the risk of credential reuse across multiple systems. Which policy is most effective?
Select an answer first
33foundation · easy
In a pass-the-hash attack, what does the attacker use to authenticate to a remote system?
Select an answer first
34foundation · easy
What is the primary function of a keylogger?
Select an answer first
35expert · hard
A company's web application is being targeted by a brute-force attack. The security team wants to slow down the attack without affecting legitimate users who occasionally mistype their passwords. Which control is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.