An organization uses Google Cloud with OAuth 2.0 for third-party application access. A penetration tester discovers that a third-party application has been granted offline access to users' Google Drive files. The tester wants to demonstrate the risk of token abuse. Which action best demonstrates this risk?

Use a phishing email to trick users into revealing their Google passwords.

Perform a password spray against Google's login endpoint.

Exploit a misconfigured S3 bucket to read access tokens from logs.

Steal a refresh token from the third-party application's database and use it to obtain new access tokens.

A penetration tester is attempting to brute force a password for a cloud service that uses both per-account lockout and IP-based rate limiting. The tester has a limited time window and a large wordlist. Which approach is most likely to succeed within the time constraint?

Use a cloud VM with a static IP and spray one password per hour across all users.

Use a single IP and attempt passwords as fast as possible, hoping to guess before lockout.

Use a single IP but rotate through a list of proxy IPs, sending bursts of attempts.

Use a distributed botnet with many IPs, but keep attempts per account below the lockout threshold.

An organization uses AWS IAM with an on-premises Active Directory federated via SAML 2.0. A penetration tester discovers that the federation service's signing certificate is weak and can be forged. The tester wants to demonstrate the impact of forging a SAML response. Which attack path best demonstrates the risk?

Craft a SAML assertion with an arbitrary username and role, sign it with the forged certificate, and submit it to the AWS sign-in endpoint.

Use the forged certificate to reset the password of an on-premises Active Directory user.

Use the forged certificate to create a new IAM user in AWS.

Intercept a legitimate SAML response and replay it to obtain AWS credentials.

GIAC Cloud Penetration Tester

Domain 6Objective 1

Password Attacks on Cloud Environments GCPN Practice Questions (Page 7)

Part of the Credential Attacks and Evasion domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 31–35

31expert · hard
An organization uses Google Cloud with OAuth 2.0 for third-party application access. A penetration tester discovers that a third-party application has been granted offline access to users' Google Drive files. The tester wants to demonstrate the risk of token abuse. Which action best demonstrates this risk?
Select an answer first
32expert · hard
A penetration tester is attempting to brute force a password for a cloud service that uses both per-account lockout and IP-based rate limiting. The tester has a limited time window and a large wordlist. Which approach is most likely to succeed within the time constraint?
Select an answer first
33expert · hard
An organization uses AWS IAM with an on-premises Active Directory federated via SAML 2.0. A penetration tester discovers that the federation service's signing certificate is weak and can be forged. The tester wants to demonstrate the impact of forging a SAML response. Which attack path best demonstrates the risk?
Select an answer first
34foundation · easy
Which attack method involves trying a small set of commonly used passwords against many different user accounts to avoid triggering account lockouts?
Select an answer first
35foundation · easy
Which cloud authentication defense is specifically designed to disable an account after a certain number of failed login attempts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Password Attacks on Cloud Environments GCPN Practice Questions (Page 7)

Questions 31–35

A penetration tester is attempting to brute force a password for a cloud service that uses both per-account lockout and IP-based rate limiting. The tester has a limited time window and a large wordlist. Which approach is most likely to succeed within the time constraint?

Which attack method involves trying a small set of commonly used passwords against many different user accounts to avoid triggering account lockouts?

Which cloud authentication defense is specifically designed to disable an account after a certain number of failed login attempts?

Keep studying — Credential Attacks and Evasion