GCIH Attacking Passwords — All Questions With Answers

Question 1

An incident responder identifies a compromised workstation using a hash-based NTLM relay attack. Which specific protocol vulnerability is being exploited by the attacker to intercept and pass authentication tokens to a target server without cracking the password?

Accepted Answer

Lack of SMB signing. NTLM relay attacks exploit the lack of mutual authentication in NTLM, allowing an attacker to intercept authentication requests and forward them to a target service. This is a critical vector in internal network pivoting because it bypasses the need for plaintext credentials. Organizations must deploy SMB signing or Kerberos-only authentication to mitigate these vulnerabilities, as NTLM does not inherently verify the identity of the server receiving the request.

Answer

Kerberos TGT pass-the-ticket

Answer

LLMNR poisoning

Answer

NetBIOS broadcast vulnerability

Question 2

An organization is auditing its password policies and hash storage. Which TWO of the following practices are considered industry-standard defenses against rapid offline dictionary attacks on hashed credentials?

Accepted Answer

Implementing unique per-user salts. Salting and computationally expensive hashing functions are the primary defenses against offline attacks. By adding unique salt values, attackers cannot use precomputed rainbow tables effectively, forcing them to crack each password individually. Using slow algorithms like Argon2 or bcrypt increases the time required for every guess, making large-scale brute-force attempts computationally prohibitive for attackers. These controls are foundational for protecting user credentials against database exfiltration incidents.

Answer

Using MD5 hashing for rapid verification

Answer

Enforcing a 30-day password rotation policy

Answer

Storing passwords in plaintext with AES-256

Question 3

During an engagement, you observe an attacker attempting to perform a 'Pass-the-Hash' attack. Which THREE of the following conditions or configurations are necessary for the attacker to successfully execute this technique?

Accepted Answer

The target must accept NTLM authentication. Pass-the-Hash requires the attacker to have already obtained the NTLM hash of a user. The target system must support NTLM authentication, and the attacker must have the ability to transmit this hash to the authentication service. It does not require cracking the hash, but it does require the target to accept the hash as valid authentication material, often facilitated by a lack of Kerberos-only enforcement or legacy protocol support.

Answer

The attacker must possess the cleartext password

Answer

The target must have SMB signing disabled

Question 4

An incident responder is analyzing a memory dump from a Windows domain controller and discovers cleartext credentials cached in LSASS.memory. Which utility native to modern Windows operating systems is most commonly abused by attackers to dump this process memory without triggering basic file-activity alerts on disk?

Accepted Answer

ProcDump. Tasklist or Taskmgr are visible, but Task Manager requires GUI interaction and writes process data differently. ProcDump is a legitimate Microsoft Sysinternals tool that creates mini-dumps of processes, making it a favorite for living-off-the-land attacks against LSASS. Understanding this helps incident handlers identify legitimate administrative tools repurposed by malicious actors to bypass standard endpoint monitoring.

Answer

Tasklist

Answer

Netstat

Answer

Regedit

Question 5

An incident responder is examining a Windows 10 workstation that was compromised via a phishing email. The attacker gained initial access and then extracted cached domain credentials from the system. The responder finds evidence that the attacker used the 'reg save' command to export registry hives and later extracted password hashes offline. Which of the following registry hives would contain the local SAM database and cached domain logons that the attacker likely targeted?

Accepted Answer

HKLM\SAM and HKLM\SECURITY. The SAM hive holds local account hashes, while the SECURITY hive holds cached domain credentials used for offline logon. An attacker who exports both with 'reg save' can later extract these hashes offline using tools like secretsdump. The SYSTEM hive is required for decryption but does not itself contain the cached domain logons, making the combination of SAM and SECURITY the correct target.

Answer

HKLM\SAM and HKLM\SYSTEM

Answer

HKLM\NTDS and HKLM\SECURITY

Answer

HKLM\SYSTEM and HKLM\SOFTWARE

Question 6

During an incident response engagement at a healthcare provider, you are examining network traffic captured from a compromised Linux web server. You see repeated outbound SSH connection attempts to dozens of internal hosts on port 22, each using the username 'svc_backup' and a different password from a short list. The attempts occur at roughly 50 per second and stop after two minutes. Which password attack technique does this activity most likely represent?

Accepted Answer

Horizontal brute-force attack. The activity shows a single username with a short password list tried across many internal hosts at high speed, which is the definition of horizontal brute-force (password spraying). This technique evades account lockout by limiting attempts per account while maximizing coverage across systems. Vertical brute-force, credential stuffing, and rainbow tables do not match the distributed, live SSH pattern seen here.

Answer

Rainbow table attack

Answer

Credential stuffing attack

Answer

Vertical brute-force attack

Question 7

Refer to the exhibit. Given the hashcat output provided, which type of hash is currently being targeted by the attacker, and what is the primary risk associated with this specific attack mode?

Accepted Answer

NTLM; risk of credential theft and lateral movement. The exhibit identifies the use of mode 1000, which corresponds to NTLM hashes. The command uses attack mode 0 (straight dictionary attack). This combination is highly effective against Windows networks where NTLM is utilized. The risk is that if the NTLM hash is cracked, the attacker gains the user's secret, allowing for lateral movement or privilege escalation across the entire Windows domain environment using pass-the-hash or direct authentication.

Answer

SHA-256; risk of collision attacks

Answer

bcrypt; risk of slow brute-force degradation

Answer

Kerberos TGT; risk of Golden Ticket generation

Question 8

Which of the following describes a 'Password Spraying' attack, and why is it preferred by attackers over traditional brute-force methods against a target domain?

Accepted Answer

Using one common password against many different accounts. Password spraying involves testing a single, common password against a large list of accounts rather than testing many passwords against one account. It is preferred because it avoids triggering account lockout thresholds, which are designed to detect traditional brute-force attacks. By keeping the authentication frequency low per account, attackers can stay under the radar of automated security monitoring systems while significantly increasing the likelihood of compromising at least one account.

Answer

Testing thousands of passwords against a single high-privileged account

Answer

Capturing hashes via packet sniffing and offline cracking

Answer

Injecting malicious code into the authentication form

Question 9

Which of the following best describes the risk of using 'credential stuffing' against a web application, and how does it differ from a standard dictionary attack?

Accepted Answer

Stuffing tests leaked credentials; dictionary attacks guess passwords. Credential stuffing uses previously leaked username/password pairs from one service to gain unauthorized access to another. It differs from a dictionary attack because it utilizes valid, known credentials rather than guessing passwords. This is highly effective because users often reuse passwords across multiple sites, making it a critical threat to organizations that do not enforce multifactor authentication (MFA) or monitor for logins from unusual locations.

Answer

Dictionary attacks use compromised lists; stuffing uses random passwords

Answer

Dictionary attacks are faster than credential stuffing

Answer

Stuffing targets the database; dictionary attacks target the login

Question 10

When analyzing a compromised system, you find evidence of 'Kerberoasting'. What is the primary objective of this attack, and what specific artifact is the attacker attempting to acquire?

Accepted Answer

Acquiring the TGS; goal is to crack service account passwords. The primary objective of Kerberoasting is to obtain service tickets for service accounts with Service Principal Names (SPNs). The attacker requests a TGS (Ticket Granting Service) ticket for a service account, which is encrypted using the account's password hash. By extracting this ticket, the attacker can move the data offline and attempt to crack the password hash without further interaction with the Domain Controller, avoiding detection by account lockout policies.

Answer

Acquiring the TGT; goal is to forge Golden Tickets

Answer

Acquiring the NTLM hash; goal is Pass-the-Hash

Answer

Acquiring the PAC; goal is privilege escalation

Question 11

Refer to the exhibit. Given the provided log entry, which attack is likely occurring, and what does the sub-status code indicate?

Accepted Answer

Brute-force/Dictionary attack; 0xC000006A means bad password. Event ID 4625 with sub-status 0xC000006A indicates a failed logon due to a bad password. When this appears repeatedly from a single source for an administrative account, it strongly suggests a brute-force or dictionary attack. The NTLM authentication process indicates that the attacker is attempting to authenticate using the legacy NTLM protocol, which is a common indicator of targeted attacks against Windows environments.

Answer

Pass-the-Hash; 0xC000006A means the hash is expired

Answer

Account lockout; 0xC000006A means account is disabled

Answer

Kerberoasting; 0xC000006A means SPN not found

Question 12

Which of the following best explains why 'Rainbow Tables' are less effective against modern systems that implement salted hashes?

Accepted Answer

Salts negate the precomputed nature of rainbow tables. Rainbow tables are precomputed tables of hashes for all possible plaintext passwords within a specific character set. By adding a random, per-user salt before hashing, the final hash becomes dependent on both the password and the salt. This means an attacker would need to build a new rainbow table for every unique salt, rendering precomputed tables computationally useless.

Answer

Salting increases the length of the hash, causing buffer overflows

Answer

Salts make the total hash space too large to compute

Answer

Salts slow down the hashing algorithm significantly

Question 13

When performing a password audit, you identify the use of 'PBKDF2-HMAC-SHA256' for credential storage. What makes this a strong choice compared to basic salted hashes, and how does it specifically hinder offline attacks?

Accepted Answer

It stretches the password, making individual guesses slow. PBKDF2 (Password-Based Key Derivation Function 2) is a key stretching algorithm that applies a pseudorandom function repeatedly to the input password and salt. This 'stretching' makes the process intentionally slow. By increasing the iteration count, defenders force the attacker to expend significantly more CPU time for each guess, making brute-force or dictionary attacks prohibitively slow compared to standard hashing methods.

Answer

It uses hardware-specific instructions to prevent GPU cracking

Answer

It encrypts the hash so it cannot be decrypted

Answer

It requires a secret key that is stored on a HSM

Question 14

What is the primary vulnerability exploited by the 'Responder' tool during a network-based password attack, and why does it effectively capture sensitive information?

Accepted Answer

It leverages LLMNR/NBT-NS spoofing to capture NTLM hashes. Responder exploits the fact that Windows clients automatically broadcast name resolution requests (LLMNR/NBT-NS) when DNS resolution fails. Responder acts as an imposter, claiming to be the requested server. The client then attempts to authenticate to the attacker's machine, sending its NTLM hash. This is effective because it exploits native, legacy Windows behavior that is often enabled by default in internal networks.

Answer

It exploits weak encryption in SMB signing

Answer

It intercepts plaintext passwords via ARP spoofing

Answer

It performs Man-in-the-Middle on encrypted Kerberos tickets

Question 15

Which of the following password security practices is most effective at preventing the use of 'weak' passwords that are easily identified by dictionary attacks?

Accepted Answer

Using a banned password list during creation. Implementing a 'banned password list' (often called a common password list) checks user-chosen passwords against a database of previously leaked or commonly used passwords during the password change event. This prevents users from selecting passwords that are trivial to crack via dictionary attacks, effectively shifting the user base toward higher-entropy, more secure credentials.

Answer

Mandating password changes every 90 days

Answer

Requiring a combination of uppercase and special characters

Answer

Storing all passwords in a secure password manager

Question 16

Refer to the exhibit. What is the goal of the 'sekurlsa::logonpasswords' command in the Mimikatz tool, and why is it considered a 'game over' scenario for a compromised system?

Accepted Answer

It retrieves cleartext credentials from LSASS memory. The 'sekurlsa::logonpasswords' command extracts cleartext passwords and NTLM hashes for all users who have recently logged into the system, directly from the LSASS memory process. This is a 'game over' scenario because the attacker gains valid, active credentials, allowing them to impersonate the user across the entire network, often without needing to perform further brute-force or cracking attacks.

Answer

It cracks the SAM database file offline

Answer

It resets the local Administrator password

Answer

It clears the event logs to hide the attack

Question 17

An incident responder is investigating a Windows domain controller and discovers that an attacker has successfully dumped the NTDS.dit database. During offline analysis, the responder needs to prioritize cracking accounts with weak passwords using Hashcat. Which hash mode should be explicitly specified for cracking standard Windows NT LAN Manager (NTLM) password hashes extracted from this database?

Accepted Answer

Mode 1000, which corresponds directly to standard NTLM password hashes.. Hashcat mode 1000 specifically targets NTLM password hashes, which are stored within the NTDS.dit database. Modern Windows environments heavily rely on NTLM for authentication fallback and pass-the-hash attacks, making these hashes critical targets for offline cracking during incident response engagements. Accurately identifying and utilizing the correct hash algorithm identifier ensures that computing resources are focused efficiently without wasting time on incompatible parsing formats.

Answer

Mode 3000, which is designated for legacy LAN Manager hashes.

Answer

Mode 5600, which targets NetNTLMv2 network authentication captures.

Answer

Mode 13100, which is utilized for Kerberos 5 TGS-REP etype 23 tickets.

Question 18

An incident handler is reviewing compromised Active Directory domain credentials and notices that an attacker successfully recovered the cleartext password of a service account using an offline cracking tool. Which specific technique did the attacker most likely leverage to target this non-user domain object?

Accepted Answer

Kerberoasting by requesting a service ticket for an SPN and cracking it offline.. Kerberoasting allows any authenticated domain user to request a Service Principal Name ticket, extract the service ticket encrypted with the target service account's NTLM hash, and crack it offline without generating account lockout events. This represents a primary threat for enterprise service accounts utilizing weak passwords.

Answer

AS-REP Roasting targeting user accounts with Kerberos pre-authentication disabled.

Answer

NTLM relaying against local SMB signing configurations.

Answer

Pass-the-Hash utilizing harvested NTLM password hashes from memory.

Question 19

During an incident response engagement, you capture SMB authentication traffic on a subnet where an attacker has positioned a rogue device. The traffic shows NTLMv2 challenge/response pairs being relayed to a file server that does not enforce SMB signing. Which of the following best describes the security control that would have most directly prevented the relayed authentication from succeeding?

Accepted Answer

Enforcing SMB signing on the target file server. SMB signing is the specific control that prevents NTLM relay to SMB file servers because it requires the client and server to sign every message with a session key. A relayed authentication cannot satisfy signing because the attacker does not possess the negotiated session key. Other controls like disabling NetBIOS or requiring Kerberos do not address the fundamental relay path over SMB.

Answer

Enabling Extended Protection for Authentication on the domain controller

Answer

Disabling NetBIOS over TCP/IP on all workstations

Answer

Requiring Kerberos authentication for all domain logons

Question 20

During an incident response engagement at a financial firm, you are reviewing authentication logs on a Windows Server 2019 domain controller. You notice a series of failed logon attempts with Event ID 4625, all originating from a single source IP, using a list of 500 common usernames but only one password attempt per username. The attempts occur over a period of 30 minutes. Which type of password attack is most likely being executed?

Accepted Answer

Password spraying. The pattern of many usernames with a single password attempt each is characteristic of password spraying. This technique avoids lockout by keeping failed attempts per account low while testing a common password across many accounts. Credential stuffing uses breached pairs, brute-force targets one account, and rainbow tables are offline. Thus, password spraying is the correct identification.

Answer

Brute-force attack

Answer

Credential stuffing

Answer

Rainbow table attack

GCIH Attacking Passwords — All Questions With Answers

An incident responder identifies a compromised workstation using a hash-based NTLM relay attack. Which specific protocol vulnerability is being exploited by the attacker to intercept and pass authentication tokens to a target server without cracking the password?

An organization is auditing its password policies and hash storage. Which TWO of the following practices are considered industry-standard defenses against rapid offline dictionary attacks on hashed credentials?

During an engagement, you observe an attacker attempting to perform a 'Pass-the-Hash' attack. Which THREE of the following conditions or configurations are necessary for the attacker to successfully execute this technique?

Refer to the exhibit. Given the hashcat output provided, which type of hash is currently being targeted by the attacker, and what is the primary risk associated with this specific attack mode?

Exhibit

Which of the following describes a 'Password Spraying' attack, and why is it preferred by attackers over traditional brute-force methods against a target domain?

Which of the following best describes the risk of using 'credential stuffing' against a web application, and how does it differ from a standard dictionary attack?

When analyzing a compromised system, you find evidence of 'Kerberoasting'. What is the primary objective of this attack, and what specific artifact is the attacker attempting to acquire?

Refer to the exhibit. Given the provided log entry, which attack is likely occurring, and what does the sub-status code indicate?

Exhibit

Which of the following best explains why 'Rainbow Tables' are less effective against modern systems that implement salted hashes?

When performing a password audit, you identify the use of 'PBKDF2-HMAC-SHA256' for credential storage. What makes this a strong choice compared to basic salted hashes, and how does it specifically hinder offline attacks?

What is the primary vulnerability exploited by the 'Responder' tool during a network-based password attack, and why does it effectively capture sensitive information?

Which of the following password security practices is most effective at preventing the use of 'weak' passwords that are easily identified by dictionary attacks?

Refer to the exhibit. What is the goal of the 'sekurlsa::logonpasswords' command in the Mimikatz tool, and why is it considered a 'game over' scenario for a compromised system?

Exhibit

An attacker has obtained a set of NTLM hashes from a compromised workstation and now wants to use them to authenticate to other systems in the domain without cracking them. Which two of the following conditions are necessary for a successful Pass-the-Hash attack? (Choose two.)

An incident responder is analyzing a compromised Linux server and discovers that the attacker has added a new user account with a password hash in /etc/shadow. The responder notes that the hash begins with '$6$'. Which of the following best describes the hashing algorithm used for this password?

GCIH Attacking Passwords — All Questions With Answers

An incident responder identifies a compromised workstation using a hash-based NTLM relay attack. Which specific protocol vulnerability is being exploited by the attacker to intercept and pass authentication tokens to a target server without cracking the password?

An organization is auditing its password policies and hash storage. Which TWO of the following practices are considered industry-standard defenses against rapid offline dictionary attacks on hashed credentials?

During an engagement, you observe an attacker attempting to perform a 'Pass-the-Hash' attack. Which THREE of the following conditions or configurations are necessary for the attacker to successfully execute this technique?

Refer to the exhibit. Given the hashcat output provided, which type of hash is currently being targeted by the attacker, and what is the primary risk associated with this specific attack mode?

Exhibit

Which of the following describes a 'Password Spraying' attack, and why is it preferred by attackers over traditional brute-force methods against a target domain?

Which of the following best describes the risk of using 'credential stuffing' against a web application, and how does it differ from a standard dictionary attack?

When analyzing a compromised system, you find evidence of 'Kerberoasting'. What is the primary objective of this attack, and what specific artifact is the attacker attempting to acquire?

Refer to the exhibit. Given the provided log entry, which attack is likely occurring, and what does the sub-status code indicate?

Exhibit

Which of the following best explains why 'Rainbow Tables' are less effective against modern systems that implement salted hashes?

When performing a password audit, you identify the use of 'PBKDF2-HMAC-SHA256' for credential storage. What makes this a strong choice compared to basic salted hashes, and how does it specifically hinder offline attacks?

What is the primary vulnerability exploited by the 'Responder' tool during a network-based password attack, and why does it effectively capture sensitive information?

Which of the following password security practices is most effective at preventing the use of 'weak' passwords that are easily identified by dictionary attacks?

Refer to the exhibit. What is the goal of the 'sekurlsa::logonpasswords' command in the Mimikatz tool, and why is it considered a 'game over' scenario for a compromised system?

Exhibit

An attacker has obtained a set of NTLM hashes from a compromised workstation and now wants to use them to authenticate to other systems in the domain without cracking them. Which two of the following conditions are necessary for a successful Pass-the-Hash attack? (Choose two.)

An incident responder is analyzing a compromised Linux server and discovers that the attacker has added a new user account with a password hash in /etc/shadow. The responder notes that the hash begins with '$6$'. Which of the following best describes the hashing algorithm used for this password?