Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.
Sign up to join this community
Cryptographic work is spent verifying transactions on Ethereum, without which, there would be little to nothing preventing colluding to start a 51% attack or creating false identities to start a Sybil Attack.
What counteractive measures do testnets have set in place to prevent such attacks?
The Ropsten testnet uses proof-of-work, and can be cheaply attacked for the reasons you give. It has been attacked on several occasions in the past. This generally makes it unreliable for testing applications on, although sometimes this is a risk worth taking to use a testnet which is as close as possible to the rules of the main network.
To allow testing without worrying about low-cost 51% attacks, alternative testnets have been created which instead use proof-of-authority, using a consortium of trusted parties, instead of proof-of-work. The most commonly-used are Rinkeby and Kovan.
See this question for more information on the different testnets: Comparison of the different TestNets
