A company's cloud accounts were compromised. The investigation reveals that the passwords used were the same as those found in a recent breach of a different online service. The accounts did not have MFA. Which recommendation would best prevent this type of attack in the future?

Require users to change passwords every 90 days.

Use a longer password minimum of 16 characters.

Block all access from foreign IP addresses.

Enforce MFA for all cloud accounts.

An attacker compromises a third-party identity provider that is federated with an organization's AWS environment. The attacker forges a SAML assertion and assumes a role in AWS. Which type of attack does this represent?

Brute force attack on the AWS API.

Password spraying against the AWS console.

Cloud identity provider attack via federation token abuse.

Credential stuffing against AWS IAM.

A red team is conducting a password spraying attack against a cloud identity provider. The organization has implemented conditional access policies that block sign-ins from suspicious IPs and require MFA for new devices. Which technique would best help the red team avoid triggering these policies?

Use a VPN service with shared IPs to hide the attack source.

Perform the attack from a Tor exit node to anonymize the source.

Use a single cloud VM IP address and send requests as fast as possible.

Use a slow, distributed attack from residential IP addresses that are not on threat intelligence lists.

A penetration tester is assessing an organization's Azure AD environment. The tester wants to perform a password spraying attack against 2,000 user accounts using a small list of common passwords. The organization has a lockout threshold of 10 failed attempts per 15 minutes. Which approach best balances effectiveness with avoiding account lockouts?

Try one password against all 2,000 accounts, wait 15 minutes, then try the next password.

Try all 10 passwords against each account sequentially before moving to the next account.

Use a distributed botnet to send 10 passwords to each account from different IPs simultaneously.

Try 10 passwords against all accounts in one burst, then wait 15 minutes and repeat.

GIAC Cloud Penetration Tester

Domain 6Objective 1

Password Attacks on Cloud Environments GCPN Practice Questions (Page 6)

Part of the Credential Attacks and Evasion domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 26–30

26application · medium
A company's cloud accounts were compromised. The investigation reveals that the passwords used were the same as those found in a recent breach of a different online service. The accounts did not have MFA. Which recommendation would best prevent this type of attack in the future?
Select an answer first
27foundation · easy
Which technique is used to capture credentials by recording a user's keystrokes on a compromised device?
Select an answer first
28application · medium
An attacker compromises a third-party identity provider that is federated with an organization's AWS environment. The attacker forges a SAML assertion and assumes a role in AWS. Which type of attack does this represent?
Select an answer first
29application · medium
A red team is conducting a password spraying attack against a cloud identity provider. The organization has implemented conditional access policies that block sign-ins from suspicious IPs and require MFA for new devices. Which technique would best help the red team avoid triggering these policies?
Select an answer first
30application · medium
A penetration tester is assessing an organization's Azure AD environment. The tester wants to perform a password spraying attack against 2,000 user accounts using a small list of common passwords. The organization has a lockout threshold of 10 failed attempts per 15 minutes. Which approach best balances effectiveness with avoiding account lockouts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Password Attacks on Cloud Environments GCPN Practice Questions (Page 6)

Questions 26–30

A company's cloud accounts were compromised. The investigation reveals that the passwords used were the same as those found in a recent breach of a different online service. The accounts did not have MFA. Which recommendation would best prevent this type of attack in the future?

Which technique is used to capture credentials by recording a user's keystrokes on a compromised device?

An attacker compromises a third-party identity provider that is federated with an organization's AWS environment. The attacker forges a SAML assertion and assumes a role in AWS. Which type of attack does this represent?

A red team is conducting a password spraying attack against a cloud identity provider. The organization has implemented conditional access policies that block sign-ins from suspicious IPs and require MFA for new devices. Which technique would best help the red team avoid triggering these policies?

Keep studying — Credential Attacks and Evasion