Password Attacks on Cloud Environments GCPN Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An attacker compromises a cloud identity provider's signing certificate and forges tokens to access a cloud service. The organization has MFA enabled for all users. Why did MFA not prevent this attack?

   • AMFA was not enforced for the identity provider's admin account.
   • BMFA protects user authentication, not the integrity of the identity provider's token-signing process.
   • CMFA only protects against password-based attacks, not token theft.
   • DMFA was bypassed because the attacker used a phishing attack.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary reason password spraying is effective against cloud identity providers?

   • AIt avoids triggering account lockouts by using a small number of attempts per account
   • BIt uses a large list of passwords for each account
   • CIt targets accounts with MFA disabled
   • DIt exploits weak password policies
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is tasked with assessing the password security of a cloud-based application. The tester has a list of employee email addresses and wants to identify weak passwords. Which combination of techniques would be most efficient and effective?

   • AUse credential stuffing with a list of passwords from a recent breach.
   • BPerform a password spray using a list of common passwords against all users.
   • CSend a phishing email to all employees to harvest their passwords.
   • DPerform a brute force attack against a single user with a large wordlist.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which attack involves stealing a valid token and replaying it to access cloud resources?

   • AToken replay
   • BPhishing
   • CPassword spraying
   • DBrute force
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to defend against password spraying attacks on its Azure AD environment. Which combination of controls would be most effective?

   • ARequire complex passwords and disable account lockout.
   • BEnable legacy authentication and rely on network firewalls.
   • CUse single sign-on and disable self-service password reset.
   • DEnforce MFA for all users and enable smart lockout.
   Reveal Solution Discussion Select an answer first