An organization wants to reduce the risk of password spraying attacks against its cloud-based email service. The security team can implement one control. Which control is most effective?

Lock out accounts after 3 failed attempts

Block all traffic from outside the corporate network

Enable multi-factor authentication for all users

Require passwords to be at least 20 characters

What is the primary purpose of monitoring for multiple failed login attempts?

To detect potential brute-force or password spraying attacks

To block all external network traffic

To enforce password expiration policies

To encrypt user passwords in transit

Employees at a company receive an email that appears to be from the IT help desk, asking them to 'verify their password' by clicking a link and entering their credentials on a page that looks like the company's login portal. Several employees have already fallen for this. Which combination of controls would best reduce the success of this type of attack?

Deploy email filtering that blocks phishing emails and implement multi-factor authentication on the corporate login portal.

Block the specific phishing URL in the web proxy.

Send a company-wide email warning users not to click links and ask them to change their passwords.

Require users to use a password manager that auto-fills credentials only on the legitimate domain.

A dictionary attack is most effective against which type of password?

A random 16-character password with symbols

A password that is changed frequently

A common word or phrase found in a wordlist

A password stored in a hardware security module

GIAC Cyber Incident Leader

Domain 1Objective 2

Credential Attacks GCIL Practice Questions (Page 8)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 36–40

36application · medium
An organization wants to reduce the risk of password spraying attacks against its cloud-based email service. The security team can implement one control. Which control is most effective?
Select an answer first
37foundation · easy
What type of credential is exploited in a pass-the-ticket attack?
Select an answer first
38foundation · easy
What is the primary purpose of monitoring for multiple failed login attempts?
Select an answer first
39application · medium
Employees at a company receive an email that appears to be from the IT help desk, asking them to 'verify their password' by clicking a link and entering their credentials on a page that looks like the company's login portal. Several employees have already fallen for this. Which combination of controls would best reduce the success of this type of attack?
Select an answer first
40foundation · easy
A dictionary attack is most effective against which type of password?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Credential Attacks GCIL Practice Questions (Page 8)

Questions 36–40

An organization wants to reduce the risk of password spraying attacks against its cloud-based email service. The security team can implement one control. Which control is most effective?

What type of credential is exploited in a pass-the-ticket attack?

What is the primary purpose of monitoring for multiple failed login attempts?

A dictionary attack is most effective against which type of password?

Keep studying — Attack Types and Vectors