You are assessing a legacy system that stores unsalted MD5 hashes. You have a large rainbow table set that covers the 8-character alphanumeric keyspace. However, the system also supports 9-character passwords. What is the most significant limitation of using rainbow tables for this assessment?

Rainbow tables only work on Windows hashes

Rainbow tables require more storage than a dictionary attack

Rainbow tables are slower than brute-force attacks

Rainbow tables cannot crack passwords longer than 8 characters

A company wants to mitigate password spraying and credential stuffing attacks against their VPN. They already have a strong password policy. Which additional control would be most effective?

Implement multi-factor authentication (MFA)

Disable account lockout to avoid denial of service

Increase the account lockout threshold to 10 attempts

What is the primary goal of a password spraying attack?

To try many passwords against a single account

To try a few common passwords against many accounts to avoid lockouts

You are cracking a set of NTLM hashes with Hashcat on a multi-GPU system. The current mask attack is using the full 8-character keyspace. You want to reduce the time to completion without losing the ability to crack passwords that match the company's policy (minimum 8 characters, must include uppercase, lowercase, and digits). Which optimization is most effective?

Use a larger wordlist with rules

Use a mask that enforces at least one uppercase, one lowercase, and one digit

Use a smaller character set, such as only lowercase

What is a primary limitation of rainbow table attacks?

They are ineffective against unsalted hashes

They can only crack passwords up to 8 characters

They require GPU acceleration to work

They require large storage space for precomputed tables

GIAC Penetration Tester (GPEN)

Domain 3Objective 4

Advanced Password Attacks GPEN Practice Questions (Page 3)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

15concepts

Questions 11–15

11application · medium
You are assessing a legacy system that stores unsalted MD5 hashes. You have a large rainbow table set that covers the 8-character alphanumeric keyspace. However, the system also supports 9-character passwords. What is the most significant limitation of using rainbow tables for this assessment?
Select an answer first
12application · medium
A company wants to mitigate password spraying and credential stuffing attacks against their VPN. They already have a strong password policy. Which additional control would be most effective?
Select an answer first
13foundation · easy
What is the primary goal of a password spraying attack?
Select an answer first
14application · medium
You are cracking a set of NTLM hashes with Hashcat on a multi-GPU system. The current mask attack is using the full 8-character keyspace. You want to reduce the time to completion without losing the ability to crack passwords that match the company's policy (minimum 8 characters, must include uppercase, lowercase, and digits). Which optimization is most effective?
Select an answer first
15foundation · easy
What is a primary limitation of rainbow table attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.