Why do attackers use a small number of passwords in a password spraying attack?

To comply with password policies

To increase the chance of guessing the password

To avoid triggering account lockout policies

A client is concerned that employees reuse passwords across personal and corporate accounts. You are asked to demonstrate the risk. You have a breach database with 10 million username/password pairs. What is the most effective way to test if corporate accounts are vulnerable?

Perform a brute-force attack on a single account

Run a dictionary attack with the top 1,000 passwords against all corporate usernames

Use a rule-based attack on the breach database to generate variations

Use the breach database to attempt login with the same username and password on the corporate VPN

An organization wants to defend against password spraying and credential stuffing attacks. Which combination of controls would be most effective?

Use a password manager and require periodic password changes

Increase password length to 20 characters and disable account lockout

Enforce MFA and implement a banned password list

Implement smart card authentication and disable MFA

What is the main advantage of using a mask attack over a brute-force attack?

It works without knowing the hash type

It guarantees finding the password faster

It uses less CPU than brute-force

It reduces the keyspace by focusing on likely character positions

GIAC Penetration Tester (GPEN)

Domain 3Objective 4

Advanced Password Attacks GPEN Practice Questions (Page 8)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

15concepts

Questions 36–40

36foundation · easy
Which attack method systematically tries every possible combination of characters up to a specified length, making it the most thorough but often the slowest approach?
Select an answer first
37foundation · easy
Why do attackers use a small number of passwords in a password spraying attack?
Select an answer first
38application · medium
A client is concerned that employees reuse passwords across personal and corporate accounts. You are asked to demonstrate the risk. You have a breach database with 10 million username/password pairs. What is the most effective way to test if corporate accounts are vulnerable?
Select an answer first
39application · medium
An organization wants to defend against password spraying and credential stuffing attacks. Which combination of controls would be most effective?
Select an answer first
40foundation · easy
What is the main advantage of using a mask attack over a brute-force attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.