PEN-200 Password Attacks Practice Test 2 — 15 Questions

Question 1

You have successfully obtained a NTLM hash dump from a domain controller. You intend to perform a pass-the-hash attack to move laterally. What is the most critical requirement for this technique to succeed in a modern Windows environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authentication protocol must permit NTLM or legacy authentication methods to facilitate the hash usage.. Pass-the-hash (PtH) relies on the fact that authentication protocols like NTLM require the hash itself rather than the cleartext password. Understanding this mechanism is vital because it allows attackers to impersonate users without needing to crack complex passwords. The technique effectively bypasses the need for plaintext credentials, making it a staple for lateral movement in internal penetration tests when local administrator or service account access is achieved.

Answer

The target system must have the Kerberos pre-authentication disabled for the user account.

Answer

The victim machine must have the 'Restricted Admin' mode enabled in the RDP configuration.

Answer

The target machine must be running a version of Windows older than Windows Server 2012.

Question 2

Refer to the exhibit. What is the primary purpose of the command provided?

Accepted Answer

Cracking NTLM hashes using a dictionary-based approach.. This command initiates a dictionary attack against NTLM hashes. Mode 1000 is specifically designated for NTLM authentication hashes, while -a 0 denotes a straight dictionary attack using a wordlist. Knowing how to map hash formats to their corresponding Hashcat mode is a fundamental skill for password cracking. Incorrectly identifying the mode or the attack type will result in an inability to recover the plaintext credentials during a penetration test.

Answer

Performing a brute-force attack on a SHA-256 encrypted archive.

Answer

Attempting a mask attack to guess passwords based on a specific pattern.

Answer

Extracting domain user hashes from a SAM database file.

Question 3

You are auditing a web application and notice it uses base64 encoding to store user credentials in a cookie. What is the most accurate assessment of this security practice?

Accepted Answer

The implementation is insecure because base64 is an encoding, not a cryptographic protection.. Base64 is an encoding scheme, not an encryption or hashing algorithm. It is completely reversible and provides zero confidentiality for sensitive data. An attacker can easily decode these values to reveal plaintext credentials. This is a common finding in penetration tests that highlights a lack of understanding of the difference between obfuscation and actual security controls, requiring immediate remediation to protect session integrity.

Answer

The credentials are secure because base64 is difficult to reverse without the secret key.

Answer

The credentials are protected from casual inspection but vulnerable to automated tools.

Answer

The implementation is acceptable if the connection is encrypted with TLS.

Question 4

During an engagement, you capture an AS-REP response from the domain controller. What is the specific prerequisite for this account to be vulnerable to AS-REP Roasting?

Accepted Answer

The account must have the 'Do not require Kerberos pre-authentication' option enabled.. AS-REP Roasting is possible when a user account has the 'Do not require Kerberos pre-authentication' attribute enabled in Active Directory. This allows an attacker to request a ticket for the user without needing the correct password, which can then be cracked offline. Understanding this specific AD attribute is critical for identifying vulnerable accounts during internal reconnaissance, as it represents a significant misconfiguration that simplifies the path to credential recovery.

Answer

The account must have a Service Principal Name (SPN) set in the domain properties.

Answer

The user must be a member of the Domain Admins or Enterprise Admins group.

Answer

The account must be configured with a password that has never been rotated.

Question 5

Which of the following describes the risk associated with using a password manager that lacks a master password and relies solely on local file encryption?

Accepted Answer

The encryption keys are stored in a predictable location or memory, allowing for easy extraction.. Password managers are designed to consolidate credentials, but they are only as secure as their master secret. Without a master password, the vault relies on the security of the host filesystem. If an attacker gains local access or performs a memory dump, the keys are easily extractable. This concept is vital for understanding how credential storage mechanisms can be exploited when the primary authentication factor is absent or bypassed.

Answer

The vault is vulnerable to dictionary attacks due to the lack of a salt in the local file.

Answer

The lack of a master password prevents the use of multi-factor authentication for the vault.

Answer

The file format will be incompatible with standard password cracking software like John the Ripper.

Question 6

Refer to the exhibit. As an attacker attempting to brute-force a web login, why is receiving this specific error message beneficial to your engagement?

Accepted Answer

It reveals information that allows you to prune your wordlist to only relevant password candidates.. This error message provides actionable intelligence regarding the target's password policy. By confirming the complexity requirements, you can refine your wordlists or mask attacks to target only valid password formats, drastically reducing the search space. This minimizes the time spent on invalid attempts and increases the probability of finding a match. Understanding how to leverage application feedback is a hallmark of efficient password-based exploitation.

Answer

It indicates that the account is currently locked and will not accept further attempts.

Answer

It confirms that the application uses a weak hashing algorithm that ignores complexity.

Answer

It implies that the application is vulnerable to SQL injection because of poor error handling.

Question 7

You have captured a NetNTLMv2 hash during a man-in-the-middle attack. What is the most effective approach to use this hash to gain access to the target machine?

Accepted Answer

Attempt to relay the hash to another system that has SMB signing disabled.. NetNTLMv2 hashes are challenge-response hashes, not password hashes. They cannot be used in a pass-the-hash attack. Instead, they must be cracked offline to obtain the plaintext password or relayed to a target that supports NTLM authentication. Recognizing the distinction between NetNTLM and NTLM is a critical concept in OSCP-level testing, as it prevents the misuse of these credentials during lateral movement.

Answer

Use the hash directly in a pass-the-hash attack against an RDP session.

Answer

The hash can be used to authenticate to the Domain Controller for domain persistence.

Answer

Directly inject the hash into the LSASS process to create a new user session.

Question 8

In the context of password cracking, what is a 'rule' in tools like Hashcat or John the Ripper?

Accepted Answer

A transformation applied to dictionary words to simulate common password modifications.. Rules allow attackers to transform wordlist entries into more complex passwords, such as adding numbers, changing casing, or substituting characters. This is a critical technique because it allows a small wordlist to cover a much larger search space of possible passwords. Mastering rules is essential for efficient credential recovery, as it enables the simulation of common user password creation habits without needing massive, unmanageable wordlists.

Answer

A predefined security policy set by the organization to ensure password complexity.

Answer

A configuration setting that defines the maximum length of the cracked password.

Answer

A list of known leaked passwords that the tool compares against the hash directly.

Question 9

Refer to the exhibit. The command failed to crack the NTLM hash despite using a comprehensive wordlist. What is the most likely reason for this result?

Accepted Answer

The password is not present in the provided wordlist.. The 'Exhausted' status in Hashcat indicates that all candidates in the provided wordlist were tested against the hash, but none resulted in a match. In a penetration test, this suggests that the password complexity exceeds the provided dictionary content. The attacker must now pivot to alternative strategies such as rule-based attacks, mask attacks, or using a more extensive, custom-generated wordlist tailored to the target organization's password policies.

Answer

The hash type was incorrectly specified for NTLM.

Answer

The GPU memory limit was exceeded during processing.

Answer

The hash format is corrupted or invalid.

Question 10

When performing a password spraying attack, why is it considered best practice to use a single common password against many accounts rather than many passwords against one account?

Accepted Answer

It increases the number of accounts that can be compromised simultaneously.. Password spraying leverages the low frequency of attempts per account to evade account lockout thresholds while maximizing the probability of finding at least one compromised credential. This approach is highly effective in enterprise environments where account policies restrict the number of failed login attempts per user. By spreading attempts, an attacker bypasses these security controls, whereas targeted brute-forcing of a single user would quickly trigger a lockout and alert security teams.

Answer

It is faster for the tool to process a single password.

Answer

It prevents the detection of the attack by network firewalls.

Answer

It guarantees that the password will be found for every user.

Question 11

During an internal penetration test, you obtain an NTDS.dit file and the associated SYSTEM registry hive. You need to crack the NTLM password hashes extracted from these files using Hashcat. Which command-line argument correctly specifies the hash type for standard Windows NTLM hashes?

Accepted Answer

hashcat -m 1000 -a 0 hashes.txt wordlist.txt. Hashcat mode 1000 specifically targets Windows NTLM password hashes extracted from Active Directory or SAM databases. Specifying the correct hash mode is essential because Hashcat uses specialized algorithms and optimization routines tailored to the exact cryptographic structure of each supported hash format during the attack.

Answer

hashcat -m 0 -a 0 hashes.txt wordlist.txt

Answer

hashcat -m 5600 -a 0 hashes.txt wordlist.txt

Answer

hashcat -m 3000 -a 0 hashes.txt wordlist.txt

Question 12

You compromise a Windows host and dump local account hashes with secretsdump, obtaining the NTLM hash of a local administrator. That same local administrator password was reused across every workstation in the environment. Which technique most directly allows lateral movement to other hosts using that hash without ever recovering the cleartext password?

Accepted Answer

Pass-the-Hash using the NTLM hash to authenticate to SMB on other hosts. Pass-the-Hash works because NTLM authentication relies on the stored hash to compute the challenge response, so possessing the hash equals possessing the credential for that account. With the local administrator password reused across workstations, feeding the hash to tools that support hash-based SMB authentication lets you move laterally to each host without cracking anything. Kerberos-based roasting techniques do not apply to local SAM accounts.

Answer

Kerberoasting the local administrator account to request a service ticket

Answer

AS-REP roasting the local account to recover its hash offline

Answer

Downgrading NTLM to LM and replaying the resulting LM hash

Question 13

You have obtained a copy of a Windows SAM file from a compromised host. You want to extract the NTLM hashes for offline cracking. Which of the following tools is specifically designed for this task?

Accepted Answer

secretsdump.py. Extracting NTLM hashes from a SAM file is a common post-exploitation step. secretsdump.py from Impacket is specifically built to parse SAM, SYSTEM, and other registry hives to recover local account hashes. Mimikatz focuses on memory extraction, Responder captures network traffic, and Hydra performs online brute force. Therefore, secretsdump.py is the correct tool for offline SAM parsing.

Answer

Mimikatz

Answer

Responder

Answer

Hydra

Question 14

You are performing a password spraying attack against an Active Directory environment. To avoid locking out accounts, which TWO of the following practices should you follow? (Choose two.)

Accepted Answer

Use a single password attempt per account per lockout window.. Password spraying avoids lockouts by limiting attempts per account. Using a single attempt per lockout window and monitoring the lockout policy are both critical. Attempting multiple passwords per account or using large password lists increases lockout risk. Targeting only never-logged-in accounts is irrelevant to lockout avoidance. Thus, the correct practices are to use one attempt per window and to monitor the policy.

Answer

Use a large list of common passwords for each account.

Answer

Attempt multiple passwords per account in quick succession.

Answer

Target only accounts that have never logged in.

Question 15

You have compromised a Linux system and extracted the /etc/shadow file. The root account's hash is prefixed with $6$. Which of the following statements is true regarding cracking this hash?

Accepted Answer

The hash is a SHA-512 crypt hash and can be cracked with tools like John the Ripper or Hashcat.. The $6$ prefix in /etc/shadow indicates SHA-512 crypt, a secure password hashing algorithm. It is not encryption, so it cannot be decrypted; it must be cracked. John the Ripper and Hashcat both support SHA-512 crypt and are commonly used for this purpose. The other options misidentify the algorithm or misunderstand the nature of password hashing.

Answer

The hash is a bcrypt hash and requires the Blowfish algorithm to crack.

Answer

The hash is a DES hash and can be cracked quickly due to its short key length.

Answer

The hash is encrypted with AES-256 and requires a key to decrypt.