A red team is performing a password attack against a cloud service that has both per-account lockout and IP-based rate limiting. The team has a limited budget and can only use a small number of cloud VMs. Which approach balances effectiveness and cost?

Use two VMs in different regions, rotating IPs and keeping attempts per account below the lockout threshold.

Use a single VM with a static IP and spray slowly, accepting the risk of rate limiting.

Use a commercial proxy service with thousands of IPs, but ignore the lockout threshold.

Use a single VM but rotate through free proxy lists, sending bursts of attempts.

A security team discovers that a developer's laptop was infected with a keylogger. The keylogger captured the developer's password for a cloud management console. Which additional control would have prevented the attacker from using the stolen password?

Multi-factor authentication (MFA) on the cloud console.

Network segmentation to isolate the developer's laptop.

A longer, more complex password policy.

Regularly rotating the password every 30 days.

A company wants to defend against password spraying and credential stuffing attacks on its cloud applications. Which of the following controls are effective? Select all that apply.

Disable all legacy authentication protocols

Implement conditional access policies that block risky sign-ins

Use a password blacklist to prevent common passwords

Require users to change passwords every 30 days

A penetration tester is attempting to brute force a user's password on a cloud service that uses both IP-based rate limiting and per-account lockout. The tester has access to a cloud-based proxy pool with thousands of IPs. Which approach is most likely to succeed without locking the account?

Use a distributed botnet to send attempts from many IPs simultaneously, ignoring the lockout threshold.

Send all attempts from a single proxy IP, but slow the rate to one attempt per minute.

Use a single IP but send bursts of 100 attempts, then pause for an hour.

Rotate through the proxy pool, using a different IP for each attempt, but keep the total attempts per account below the lockout threshold.

An attacker searches public code repositories and finds a configuration file containing an API key and a database password. Which credential harvesting technique does this exemplify?

Exploiting exposed configuration files

GIAC Cloud Penetration Tester

Domain 6Objective 1

Password Attacks on Cloud Environments GCPN Practice Questions (Page 3)

Part of the Credential Attacks and Evasion domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 11–15

11expert · hard
A red team is performing a password attack against a cloud service that has both per-account lockout and IP-based rate limiting. The team has a limited budget and can only use a small number of cloud VMs. Which approach balances effectiveness and cost?
Select an answer first
12application · medium
A security team discovers that a developer's laptop was infected with a keylogger. The keylogger captured the developer's password for a cloud management console. Which additional control would have prevented the attacker from using the stolen password?
Select an answer first
13application · medium · select all that apply
A company wants to defend against password spraying and credential stuffing attacks on its cloud applications. Which of the following controls are effective? Select all that apply.
Select an answer first
14expert · hard
A penetration tester is attempting to brute force a user's password on a cloud service that uses both IP-based rate limiting and per-account lockout. The tester has access to a cloud-based proxy pool with thousands of IPs. Which approach is most likely to succeed without locking the account?
Select an answer first
15foundation · easy
An attacker searches public code repositories and finds a configuration file containing an API key and a database password. Which credential harvesting technique does this exemplify?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.