You are testing a web application that has a lockout policy of 5 failed attempts per 15 minutes per account. You have a list of 10,000 usernames and a list of 20 common passwords. You need to test all usernames with at least 3 passwords within 1 hour. What is the best strategy to avoid lockouts?

Spray all 20 passwords across all usernames in one go

Try 3 passwords on each username sequentially

Spray 3 passwords across all 10,000 usernames, waiting 15 minutes between each password

Use a dictionary attack with 100 passwords per account

Which countermeasure is most effective at preventing credential stuffing attacks?

Enforcing multi-factor authentication (MFA)

What is the primary purpose of an account lockout policy?

To prevent brute-force and password spraying attacks by limiting failed attempts

To force users to change passwords regularly

What is a pass-the-ticket attack?

Using an NTLM hash to get a ticket

Forcing a user to reveal their ticket

Using a stolen Kerberos ticket to authenticate as the ticket's user

Cracking a Kerberos ticket to obtain the password

GIAC Penetration Tester (GPEN)

Domain 3Objective 4

Advanced Password Attacks GPEN Practice Questions (Page 10)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

15concepts

Questions 46–50

46expert · hard
You are testing a web application that has a lockout policy of 5 failed attempts per 15 minutes per account. You have a list of 10,000 usernames and a list of 20 common passwords. You need to test all usernames with at least 3 passwords within 1 hour. What is the best strategy to avoid lockouts?
Select an answer first
47foundation · easy
Which countermeasure is most effective at preventing credential stuffing attacks?
Select an answer first
48foundation · easy
What is the primary purpose of an account lockout policy?
Select an answer first
49application · medium
You are testing a domain where some user accounts have 'Do not require Kerberos pre-authentication' enabled. You want to obtain password hashes for offline cracking without sending any traffic to the target accounts. Which attack is most appropriate?
Select an answer first
50foundation · easy
What is a pass-the-ticket attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.