GCIH Attacking Passwords Practice Question
A security analyst is reviewing password policies for a Windows Active Directory environment. The current policy requires a minimum length of 8 characters and complexity. However, the organization wants to improve resistance against brute-force attacks. Which of the following changes would most effectively increase the time required for an offline brute-force attack against NTLM hashes?
⚠ Common exam trap
The trap here is focusing on lockout or complexity, but offline attacks ignore lockout and length is the dominant factor in resisting brute-force.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the minimum password length to 14 characters.
For offline brute-force attacks against NTLM hashes, password length is the most critical factor because it exponentially increases the search space. Other policies like history, age, and lockout are useful for online attacks but do not significantly hinder offline cracking. Thus, increasing the minimum length to 14 characters is the most effective change.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable account lockout after 5 failed attempts.
Why it's wrong here
Account lockout mitigates online brute-force attacks but has no effect on offline cracking of NTLM hashes. Once the hash is captured, the attacker can attempt billions of guesses offline without triggering lockouts. Therefore, this setting does not address the scenario's goal of resisting offline brute-force.
- ✓
Increase the minimum password length to 14 characters.
Why this is correct
Increasing password length exponentially increases the number of possible combinations, making brute-force attacks significantly slower. For NTLM hashes, which are fast to compute, length is the most effective defense. A 14-character password has vastly more entropy than an 8-character one, directly increasing cracking time. This change is the most impactful for resisting offline attacks.
- ✗
Set the maximum password age to 30 days.
Why it's wrong here
A shorter maximum password age forces more frequent changes, which can actually lead to weaker passwords as users increment or reuse patterns. It does not increase the complexity or length of a single password, so it does not make brute-force attacks harder. In fact, it may reduce overall security by encouraging predictable changes.
- ✗
Enforce password history of 24 passwords.
Why it's wrong here
Password history prevents users from reusing recent passwords, but it does not affect the strength of an individual password against brute-force. An attacker cracking a hash offline is not deterred by history; they only need to crack the current password. Thus, this change does not significantly increase brute-force resistance.
About these practice questions
One of 322 original GCIH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.