Password Attacks on Cloud Environments GCPN Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization uses Azure AD with federation to an on-premises ADFS server. A penetration tester discovers that the ADFS server has a weak token-signing certificate. Which attack is the tester most likely to execute?

   • APerform a password spray against Azure AD
   • BForge a SAML token to impersonate a user
   • CExploit a misconfigured S3 bucket
   • DSteal a user's session cookie
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A penetration tester is evaluating the security of a cloud application. The tester has a list of usernames and wants to test if any users have weak passwords. The application does not have lockout policies but does have rate limiting per IP. Which attack method is most appropriate?

   • APassword spraying with a small list of common passwords across all usernames.
   • BCredential stuffing with leaked passwords for each username.
   • CBrute force each username with a large wordlist from a single IP.
   • DPhishing users to obtain their passwords.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A penetration tester is performing a brute force attack against a web application that uses Azure AD for authentication. The application has a lockout policy of 10 failed attempts per 15 minutes per user. The tester wants to test a list of 100 passwords for a single known username without locking the account. Which strategy is most effective?

   • AUse a password spraying tool that rotates through different usernames, but only test this one user at the end.
   • BAttempt all 100 passwords in a single session, hoping the lockout counter resets before the account is locked.
   • CAttempt 9 passwords, wait 15 minutes, then attempt the next 9, repeating until all 100 are tested.
   • DUse a distributed botnet to send 100 attempts simultaneously from different IPs.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team is investigating a breach where attackers accessed cloud accounts using credentials from a previous breach. The accounts did not have MFA. The team wants to implement a control that specifically addresses credential stuffing without requiring MFA for every login. Which control is most effective?

   • AEnable account lockout after 3 failed attempts.
   • BImplement a banned password list that blocks known breached passwords.
   • CBlock all traffic from countries where the breach originated.
   • DRequire password changes every 30 days.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is reviewing logs after a suspected credential stuffing attack against the company's SaaS application. The application uses an email address and password for login and does not enforce MFA. The analyst sees thousands of failed login attempts from various IP addresses, but a few succeed. Which combination of findings most strongly indicates credential stuffing rather than a simple brute force attack?

   • AThe attack originated from a single IP address over a short period.
   • BThe failed attempts used usernames that were randomly generated and did not exist in the system.
   • CThe failed attempts all used the same password for every username.
   • DThe successful logins used passwords that match passwords found in public breach dumps for those users.
   Reveal Solution Discussion Select an answer first