A security analyst is explaining to management why credential attacks are a significant risk. Which statement is most accurate?

Credential attacks exploit weaknesses in the authentication process to gain unauthorized access

Credential attacks only affect systems without encryption

Credential attacks are only possible with physical access

Credential attacks are prevented by strong password policies alone

During an incident response, you find that an attacker used a stolen NTLM hash to authenticate to a file server without knowing the plaintext password. The hash was captured from a compromised workstation. Which control would most directly prevent this type of attack from succeeding in the future?

Deploy an endpoint detection and response (EDR) agent on all workstations.

Implement network segmentation to isolate the file server.

Enable Kerberos-only authentication and disable NTLM where possible.

Require complex passwords and enforce periodic password changes.

What is the primary source of the username/password pairs used in a credential stuffing attack?

Phishing emails that trick users into revealing passwords

Brute-force guessing of passwords

Keyloggers installed on user devices

Data breaches that expose credentials

A security architect is designing a defense against pass-the-ticket attacks in a Kerberos environment. The organization cannot afford to replace legacy applications that use Kerberos. Which control is most effective in limiting the impact of a stolen TGT?

Implement short ticket lifetimes and enforce renewal intervals.

Deploy a network intrusion detection system (NIDS).

Use longer, more complex passwords for all users.

Disable Kerberos and use NTLM instead.

GIAC Cyber Incident Leader

Domain 1Objective 2

Credential Attacks GCIL Practice Questions (Page 9)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 41–45

41application · medium
A security analyst is explaining to management why credential attacks are a significant risk. Which statement is most accurate?
Select an answer first
42application · medium
During an incident response, you find that an attacker used a stolen NTLM hash to authenticate to a file server without knowing the plaintext password. The hash was captured from a compromised workstation. Which control would most directly prevent this type of attack from succeeding in the future?
Select an answer first
43foundation · easy
What is the primary source of the username/password pairs used in a credential stuffing attack?
Select an answer first
44application · medium
A user clicks a link in an email and is taken to a website that looks like the company's login page. The user enters their credentials and then realizes the URL is incorrect. Which type of attack occurred?
Select an answer first
45expert · hard
A security architect is designing a defense against pass-the-ticket attacks in a Kerberos environment. The organization cannot afford to replace legacy applications that use Kerberos. Which control is most effective in limiting the impact of a stolen TGT?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.