A penetration tester is attempting to brute force a cloud-based web application's login endpoint. The application uses rate limiting that allows only 5 requests per minute per IP address. The tester wants to try 10,000 password combinations for a single username. Which strategy is most likely to succeed while minimizing detection?

Use a botnet to send all requests simultaneously from thousands of IPs.

Send all 10,000 requests from a single IP address as fast as possible.

Rotate through a large pool of proxy IP addresses, sending a few requests from each.

Use a single IP but wait 12 seconds between each request.

A company wants to reduce the risk of password spraying and credential stuffing against its cloud SaaS applications. The company has a hybrid identity environment with Azure AD and on-premises Active Directory. Which control is most effective at preventing these attacks?

Implement a longer password complexity policy.

Require users to change passwords every 30 days.

Enforce multi-factor authentication (MFA) for all users.

Disable legacy authentication protocols.

Which control is most effective at preventing password spraying attacks from succeeding, even if a user's password is weak?

Multi-factor authentication (MFA)

GIAC Cloud Penetration Tester

Domain 6Objective 1

Password Attacks on Cloud Environments GCPN Practice Questions (Page 2)

Part of the Credential Attacks and Evasion domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 6–10

6foundation · easy
An attacker obtains a list of username/password pairs from a public data breach and tries them against a cloud SaaS application. Which attack technique is being used?
Select an answer first
7application · medium
A penetration tester is attempting to brute force a cloud-based web application's login endpoint. The application uses rate limiting that allows only 5 requests per minute per IP address. The tester wants to try 10,000 password combinations for a single username. Which strategy is most likely to succeed while minimizing detection?
Select an answer first
8foundation · easy
Which technique is used to evade detection during a password attack by spreading attempts across multiple source IP addresses?
Select an answer first
9application · medium
A company wants to reduce the risk of password spraying and credential stuffing against its cloud SaaS applications. The company has a hybrid identity environment with Azure AD and on-premises Active Directory. Which control is most effective at preventing these attacks?
Select an answer first
10foundation · easy
Which control is most effective at preventing password spraying attacks from succeeding, even if a user's password is weak?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Password Attacks on Cloud Environments GCPN Practice Questions (Page 2)

Questions 6–10

An attacker obtains a list of username/password pairs from a public data breach and tries them against a cloud SaaS application. Which attack technique is being used?

Which technique is used to evade detection during a password attack by spreading attempts across multiple source IP addresses?

A company wants to reduce the risk of password spraying and credential stuffing against its cloud SaaS applications. The company has a hybrid identity environment with Azure AD and on-premises Active Directory. Which control is most effective at preventing these attacks?

Which control is most effective at preventing password spraying attacks from succeeding, even if a user's password is weak?

Keep studying — Credential Attacks and Evasion