Which countermeasure is most effective at preventing credential stuffing attacks?

Disabling account lockout policies

Enforcing multi-factor authentication (MFA)

Which defense is specifically designed to mitigate brute-force attacks on user accounts?

Using a single-factor authentication

Disabling password complexity requirements

A company wants to reduce the risk of credential stuffing and password spraying against its web portal. Which control is most effective?

Increase the minimum password length to 12 characters.

Disable account lockout to avoid user frustration.

Enforce multi-factor authentication (MFA) for all portal users.

Use a longer password history policy.

A tester is attempting to crack a password hash that is known to be 8 characters long and consists of lowercase letters and digits. The tester has a GPU that can test 1 billion hashes per second. The tester also has a wordlist of common 8-character passwords. Which approach is most likely to crack the hash within 30 minutes?

Run a brute-force attack with a mask of ?l?l?l?l?l?l?l?d

Run a dictionary attack with the wordlist of common 8-character passwords

Run a hybrid attack with a wordlist and a mask for digits

Run a brute-force attack with a mask of ?l?d?l?d?l?d?l?d

GIAC Penetration Tester (GPEN)

Domain 3Objective 2

Password Attacks GPEN Practice Questions (Page 9)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 41–45

41foundation · easy
Which countermeasure is most effective at preventing credential stuffing attacks?
Select an answer first
42foundation · easy
Which defense is specifically designed to mitigate brute-force attacks on user accounts?
Select an answer first
43foundation · easy
Which tool is a classic command-line password cracker that supports many hash types and is often used in Unix environments?
Select an answer first
44application · medium
A company wants to reduce the risk of credential stuffing and password spraying against its web portal. Which control is most effective?
Select an answer first
45expert · hard
A tester is attempting to crack a password hash that is known to be 8 characters long and consists of lowercase letters and digits. The tester has a GPU that can test 1 billion hashes per second. The tester also has a wordlist of common 8-character passwords. Which approach is most likely to crack the hash within 30 minutes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Password Attacks GPEN Practice Questions (Page 9)

Questions 41–45

Which countermeasure is most effective at preventing credential stuffing attacks?

Which defense is specifically designed to mitigate brute-force attacks on user accounts?

Which tool is a classic command-line password cracker that supports many hash types and is often used in Unix environments?

A company wants to reduce the risk of credential stuffing and password spraying against its web portal. Which control is most effective?

Keep studying — Password Attacks and Credential Attacks