220-1102 Practice Question: A company's network was breached, and forensic…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Require all users to change passwords every 30 days.

  Why it's wrong here

  Requiring frequent password changes, such as every 30 days, offers minimal protection against pass-the-hash attacks. Attackers exploit the *current* password hash residing in memory on a compromised system, not a previously used one. Therefore, even if a user changes their password frequently, the attacker can still capture and reuse the newly generated hash for lateral movement within its validity period, rendering this control ineffective against the specific attack vector.

• ✗

  Implement network segmentation and firewall rules.

  Why it's wrong here

  Implementing network segmentation and robust firewall rules is a crucial security best practice that limits an attacker's lateral movement across different network zones. However, this measure does not directly prevent a pass-the-hash attack from occurring within an already compromised segment. Once an attacker gains access to a system and extracts a credential hash, they can still reuse that hash to authenticate to other systems *within* the same segment or an accessible one, bypassing the segmentation's intent for that specific attack vector.

• ✓

  Enable Windows Defender Credential Guard.

  Why this is correct

  Enabling Windows Defender Credential Guard is a highly effective countermeasure specifically designed to mitigate pass-the-hash attacks by isolating credential material. It uses virtualization-based security to store NTLM password hashes and Kerberos Ticket Granting Tickets (TGTs) in a secure, isolated container, making them inaccessible to malware even if the operating system kernel is compromised. This isolation prevents attackers from extracting and reusing these critical credentials for lateral movement, directly addressing the core mechanism of pass-the-hash.

• ✗

  Disable NTLM authentication entirely.

  Why it's wrong here

  While NTLM (NT LAN Manager) is an older authentication protocol often targeted in pass-the-hash attacks, completely disabling it may cause significant compatibility issues with legacy applications and services that still rely on it. Furthermore, pass-the-hash attacks are not exclusively limited to NTLM; attackers can also leverage Kerberos tickets or other credential types. Therefore, disabling NTLM alone does not provide comprehensive protection against all forms of credential theft and reuse attacks and could disrupt business operations.

Go deeper

Related to this question