Security Operations →mediumMultiple ChoiceObjective-mapped

CAS-004 Security Operations Practice Question

During a penetration test, the tester has gained initial access to a system and wants to escalate privileges. Which of the following techniques is most likely to be effective for privilege escalation on a Windows system?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Exploiting a local privilege escalation vulnerability like CVE-2023-xxxx

Exploiting a kernel vulnerability or a misconfigured service is a common privilege escalation technique. Token manipulation and DLL hijacking are also methods, but kernel exploits are direct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Using Mimikatz to extract plaintext passwords from memory
Why it's wrong here
Password extraction can lead to lateral movement, not necessarily privilege escalation on the same system.
✓
Exploiting a local privilege escalation vulnerability like CVE-2023-xxxx
Why this is correct
Local exploits can elevate from user to admin/system.
✗
Scanning for open ports on the network
Why it's wrong here
Port scanning is reconnaissance, not escalation.
✗
Performing a phishing attack on the domain administrator
Why it's wrong here
Phishing is for initial access, not escalation.

Go deeper

CAS-004 Security Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question