A penetration tester is conducting a password spraying test against a company's Azure AD. The tester has a list of 500 usernames and wants to test 10 common passwords. The tenant has a lockout threshold of 10 failed attempts per 15 minutes per user. What is the maximum number of passwords the tester can test per user in a 15-minute window without locking the account?

Unlimited, if using different IPs

Which action is essential when executing a password spraying attack to avoid locking out accounts?

Using a single password for all accounts

Waiting for the lockout period to expire between attempts

Keeping the number of attempts per account below the lockout threshold

Using a VPN to hide the source IP

A security architect is designing defenses against password attacks for a cloud environment. The organization wants to minimize user friction while protecting against password spraying and brute force. Which combination of controls best meets this requirement?

Enable smart lockout and require MFA only for risky sign-ins.

Use complex password policies and no MFA.

Require MFA for all users and disable lockout.

Enable legacy authentication and rely on network controls.

GIAC Cloud Penetration Tester

Domain 6Objective 1

Password Attacks on Cloud Environments GCPN Practice Questions (Page 10)

Part of the Credential Attacks and Evasion domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 46–48

46application · medium
A penetration tester is conducting a password spraying test against a company's Azure AD. The tester has a list of 500 usernames and wants to test 10 common passwords. The tenant has a lockout threshold of 10 failed attempts per 15 minutes per user. What is the maximum number of passwords the tester can test per user in a 15-minute window without locking the account?
Select an answer first
47foundation · easy
Which action is essential when executing a password spraying attack to avoid locking out accounts?
Select an answer first
48expert · hard
A security architect is designing defenses against password attacks for a cloud environment. The organization wants to minimize user friction while protecting against password spraying and brute force. Which combination of controls best meets this requirement?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Password Attacks on Cloud Environments GCPN Practice Questions (Page 10)

Questions 46–48

Which action is essential when executing a password spraying attack to avoid locking out accounts?

A security architect is designing defenses against password attacks for a cloud environment. The organization wants to minimize user friction while protecting against password spraying and brute force. Which combination of controls best meets this requirement?

Keep studying — Credential Attacks and Evasion