GCIH Attacking Passwords Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. What is the goal of the 'sekurlsa::logonpasswords' command in the Mimikatz tool, and why is it considered a 'game over' scenario for a compromised system?

Accepted Answer

It retrieves cleartext credentials from LSASS memory. The 'sekurlsa::logonpasswords' command extracts cleartext passwords and NTLM hashes for all users who have recently logged into the system, directly from the LSASS memory process. This is a 'game over' scenario because the attacker gains valid, active credentials, allowing them to impersonate the user across the entire network, often without needing to perform further brute-force or cracking attacks.

Answer

It cracks the SAM database file offline

Answer

It resets the local Administrator password

Answer

It clears the event logs to hide the attack

Question 2

An incident responder is investigating a Windows domain controller and discovers that an attacker has successfully dumped the NTDS.dit database. During offline analysis, the responder needs to prioritize cracking accounts with weak passwords using Hashcat. Which hash mode should be explicitly specified for cracking standard Windows NT LAN Manager (NTLM) password hashes extracted from this database?

Accepted Answer

Mode 1000, which corresponds directly to standard NTLM password hashes.. Hashcat mode 1000 specifically targets NTLM password hashes, which are stored within the NTDS.dit database. Modern Windows environments heavily rely on NTLM for authentication fallback and pass-the-hash attacks, making these hashes critical targets for offline cracking during incident response engagements. Accurately identifying and utilizing the correct hash algorithm identifier ensures that computing resources are focused efficiently without wasting time on incompatible parsing formats.

Answer

Mode 3000, which is designated for legacy LAN Manager hashes.

Answer

Mode 5600, which targets NetNTLMv2 network authentication captures.

Answer

Mode 13100, which is utilized for Kerberos 5 TGS-REP etype 23 tickets.

Question 3

An incident handler is reviewing compromised Active Directory domain credentials and notices that an attacker successfully recovered the cleartext password of a service account using an offline cracking tool. Which specific technique did the attacker most likely leverage to target this non-user domain object?

Accepted Answer

Kerberoasting by requesting a service ticket for an SPN and cracking it offline.. Kerberoasting allows any authenticated domain user to request a Service Principal Name ticket, extract the service ticket encrypted with the target service account's NTLM hash, and crack it offline without generating account lockout events. This represents a primary threat for enterprise service accounts utilizing weak passwords.

Answer

AS-REP Roasting targeting user accounts with Kerberos pre-authentication disabled.

Answer

NTLM relaying against local SMB signing configurations.

Answer

Pass-the-Hash utilizing harvested NTLM password hashes from memory.

Question 4

During an incident response engagement, you capture SMB authentication traffic on a subnet where an attacker has positioned a rogue device. The traffic shows NTLMv2 challenge/response pairs being relayed to a file server that does not enforce SMB signing. Which of the following best describes the security control that would have most directly prevented the relayed authentication from succeeding?

Accepted Answer

Enforcing SMB signing on the target file server. SMB signing is the specific control that prevents NTLM relay to SMB file servers because it requires the client and server to sign every message with a session key. A relayed authentication cannot satisfy signing because the attacker does not possess the negotiated session key. Other controls like disabling NetBIOS or requiring Kerberos do not address the fundamental relay path over SMB.

Answer

Enabling Extended Protection for Authentication on the domain controller

Answer

Disabling NetBIOS over TCP/IP on all workstations

Answer

Requiring Kerberos authentication for all domain logons

Question 5

During an incident response engagement at a financial firm, you are reviewing authentication logs on a Windows Server 2019 domain controller. You notice a series of failed logon attempts with Event ID 4625, all originating from a single source IP, using a list of 500 common usernames but only one password attempt per username. The attempts occur over a period of 30 minutes. Which type of password attack is most likely being executed?

Accepted Answer

Password spraying. The pattern of many usernames with a single password attempt each is characteristic of password spraying. This technique avoids lockout by keeping failed attempts per account low while testing a common password across many accounts. Credential stuffing uses breached pairs, brute-force targets one account, and rainbow tables are offline. Thus, password spraying is the correct identification.

Answer

Brute-force attack

Answer

Credential stuffing

Answer

Rainbow table attack

Question 6

A penetration tester is attempting to crack NTLM hashes captured from a Windows environment. The hashes were obtained from a memory dump of a workstation. The tester decides to use Hashcat with the mode 1000. Which of the following best describes the type of hashes being cracked and the primary reason this mode is chosen?

Accepted Answer

NTLM hashes, because mode 1000 is optimized for fast brute-force attacks against unsalted MD4-based hashes.. Hashcat mode 1000 is designated for NTLM hashes, which are MD4-based and unsalted. This makes them vulnerable to rapid brute-force and dictionary attacks. The other options misidentify the hash types and their corresponding Hashcat modes. Therefore, the correct answer is the one that correctly pairs NTLM with mode 1000 and explains the speed advantage.

Answer

Kerberos 5 TGS-REP hashes, because mode 1000 extracts service account credentials from ticket-granting tickets.

Answer

NetNTLMv2 hashes, because mode 1000 captures challenge-response pairs for network authentication.

Answer

LM hashes, because mode 1000 is designed to crack the older LAN Manager hash format.

Question 7

During an internal penetration test, you capture SMB traffic between a user workstation and a file server on the same Layer 2 segment. The captured exchange shows the client sending an authentication request containing a username and a challenge/response value, but no cleartext password. You want to recover the user's cleartext password offline using a wordlist. Which attack technique should you apply to the captured challenge/response pair?

Accepted Answer

Perform an offline dictionary attack against the captured NTLMv2 challenge/response using a tool such as Hashcat with mode 5600.. The captured exchange is a NetNTLMv2 authentication, which exposes a challenge/response rather than a cleartext password or NT hash. To recover the cleartext password, an attacker performs an offline dictionary or brute-force attack against that response using a tool configured for NetNTLMv2, such as Hashcat mode 5600. This avoids further interaction with the target and does not trigger account lockouts on the server.

Answer

Extract the user's NT hash from the capture and submit it to a Pass-the-Hash tool to authenticate to the file server.

Answer

Decrypt the SMB session with the server's machine account key to reveal the user's password from the encrypted payload.

Answer

Replay the captured challenge/response value directly to the file server to authenticate as the user without cracking it.

Question 8

An incident responder is investigating a breach where attackers gained initial access via a phishing email. The email contained a malicious macro that executed a PowerShell script. The script attempted to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. Which of the following techniques is the attacker most likely using, and what is the primary goal?

Accepted Answer

Credential dumping, to obtain plaintext passwords or hashes from memory for further attacks.. The attacker is performing credential dumping from LSASS to harvest credentials. This is a common step after initial access, enabling further attacks like lateral movement or privilege escalation. The other options describe different techniques that either occur after credential dumping or target different components. Therefore, credential dumping is the correct identification.

Answer

Pass-the-Hash, to authenticate to other systems using captured NTLM hashes without knowing the plaintext password.

Answer

Golden Ticket attack, to forge Kerberos ticket-granting tickets using the KRBTGT account hash.

Answer

Kerberoasting, to request service tickets and crack their encryption offline to obtain service account passwords.

Question 9

An incident responder is reviewing logs from a Windows environment and finds that an attacker obtained the NT hash of a domain administrator through a credential dumping technique. The attacker then used that hash to authenticate to multiple servers without ever knowing the cleartext password. Which condition allowed this Pass-the-Hash authentication to succeed?

Accepted Answer

The target servers accepted NTLM authentication and the attacker supplied the NT hash directly as the response to the server challenge.. Pass-the-Hash succeeds because NTLM authentication relies on the NT hash to compute the challenge/response and never requires the cleartext password. Once an attacker extracts the NT hash, they can authenticate to any NTLM-accepting service as that user. Defenses include disabling NTLM, enforcing Kerberos, implementing credential Guard, and restricting privileged account logons to specific hardened hosts.

Answer

Kerberos was enforced across the domain, allowing the attacker to request a service ticket using the NT hash as the long-term key.

Answer

The attacker had previously obtained the cleartext password and used it to derive the NT hash on each target server.

Answer

The servers were configured to cache credentials in LSASS, which allowed the attacker to reuse the cached hash for authentication.

Question 10

A penetration tester is performing a password attack against an Active Directory environment. The tester has obtained a list of valid domain usernames and wants to identify accounts with weak passwords without locking out accounts. The domain account lockout policy is set to lock accounts after five failed attempts within 30 minutes. Which two of the following techniques would allow the tester to test passwords while minimizing the risk of account lockout? (Choose two.)

Accepted Answer

Using a tool that performs a single authentication attempt per account per lockout window. Password spraying and single-attempt-per-window techniques are both designed to test passwords while staying under lockout thresholds. Spraying uses one password across many accounts, and single-attempt-per-window limits each account to one guess per lockout period. Both avoid triggering the five-failure lockout, unlike brute-forcing or credential stuffing, which can rapidly exceed the threshold.

Answer

Using a pass-the-hash attack with captured NTLM hashes

Answer

Brute-forcing each account with a large dictionary until a valid password is found

Answer

Performing a credential stuffing attack using passwords from previous breaches

Question 11

An attacker has obtained a set of NTLM hashes from a compromised workstation and now wants to use them to authenticate to other systems in the domain without cracking them. Which two of the following conditions are necessary for a successful Pass-the-Hash attack? (Choose two.)

Accepted Answer

The target systems must accept NTLM authentication.. Pass-the-Hash requires that the target systems accept NTLM authentication and that the compromised hash belongs to an account with logon rights on those systems. Without these, the attack cannot proceed. Administrative privileges, plaintext passwords, and domain controller status are not necessary conditions, making them incorrect choices.

Answer

The target systems must be domain controllers.

Answer

The attacker must know the plaintext password associated with the hash.

Answer

The attacker must have administrative privileges on the target systems.

Question 12

A security analyst is reviewing password hashes extracted from an older Linux system. The hashes are stored in /etc/shadow and begin with the prefix $1$. The analyst wants to determine the hashing algorithm used so they can choose the correct cracking mode. Which algorithm is indicated by the $1$ prefix?

Accepted Answer

MD5 crypt. Linux shadow file prefixes identify the hashing algorithm: $1$ is MD5 crypt, $5$ is SHA-256 crypt, $6$ is SHA-512 crypt, and $2a$/$2b$/$2y$ is bcrypt. MD5 crypt is a legacy scheme that is fast to compute and therefore easily cracked with modern hardware. Analysts should recognize these prefixes to select the correct cracking mode and to advise upgrading to stronger algorithms.

Answer

SHA-512 crypt

Answer

SHA-256 crypt

Answer

bcrypt

Question 13

A security analyst is reviewing password policies for a Windows Active Directory environment. The current policy requires a minimum length of 8 characters and complexity. However, the organization wants to improve resistance against brute-force attacks. Which of the following changes would most effectively increase the time required for an offline brute-force attack against NTLM hashes?

Accepted Answer

Increase the minimum password length to 14 characters.. For offline brute-force attacks against NTLM hashes, password length is the most critical factor because it exponentially increases the search space. Other policies like history, age, and lockout are useful for online attacks but do not significantly hinder offline cracking. Thus, increasing the minimum length to 14 characters is the most effective change.

Answer

Enable account lockout after 5 failed attempts.

Answer

Set the maximum password age to 30 days.

Answer

Enforce password history of 24 passwords.

Question 14

An incident responder is analyzing a compromised Linux server and discovers that the attacker has added a new user account with a password hash in /etc/shadow. The responder notes that the hash begins with '$6$'. Which of the following best describes the hashing algorithm used for this password?

Accepted Answer

SHA-512 crypt. In /etc/shadow, the '$6$' prefix identifies SHA-512 crypt as the hashing algorithm. This is a strong, salted, and iterated algorithm commonly used on modern Linux systems. The other prefixes correspond to different algorithms: '$1$' for MD5, '$5$' for SHA-256, and '$2a$' for bcrypt. Correctly identifying the algorithm helps assess password cracking difficulty.

Answer

bcrypt

Answer

MD5 crypt

Answer

SHA-256 crypt

Question 15

An incident responder is investigating a compromised Linux server and finds that an attacker added a new user account with a password hash in /etc/shadow. The hash begins with $6$ and includes a salt. The attacker later cracked this hash offline. Which property of the hash allowed the attacker to crack it despite the salt?

Accepted Answer

The salt is stored alongside the hash and is not secret, so the attacker could use it to compute candidate hashes for each password guess.. Salts are stored with the hash and are not secret, so they do not prevent offline dictionary or brute-force attacks. They only defeat precomputed rainbow tables and ensure unique hashes for identical passwords. An attacker who obtains the shadow file can read the salt and compute candidate hashes for each guess, eventually recovering weak passwords. Strong, unique passwords and slow hashing algorithms are the real defenses.

Answer

The $6$ prefix indicates a weak algorithm that can be reversed mathematically to recover the password.

Answer

The salt was generated using a predictable pattern, allowing the attacker to precompute a rainbow table for that specific salt.

Answer

The hash was generated with a low iteration count, making it trivial to compute but not explaining how the salt was bypassed.