hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has compromised a Linux…
A penetration tester has compromised a Linux server and wants to move laterally to a Windows server. The Linux server has network access to the Windows server on port 445. The tester has a captured NTLM hash of a domain administrator account. Which technique is most likely to allow the tester to authenticate and execute commands on the Windows server?
⚠ Common exam trap
Candidates often confuse pass-the-hash with SMB relay, but relay requires intercepting a live authentication attempt, whereas pass-the-hash directly uses the captured hash to authenticate without any relay.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-the-hash using Impacket's psexec
The tester has a captured NTLM hash of a domain administrator account and network access to the Windows server on port 445 (SMB). Pass-the-hash (PtH) allows authentication using the NTLM hash directly without needing the plaintext password. Impacket's psexec uses the SMB protocol to authenticate with the hash and execute commands remotely, making it the most direct and effective technique for lateral movement in this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pass-the-hash using Impacket's psexec
Why this is correct
Pass-the-hash (PtH) with Impacket's psexec.py allows the tester to authenticate to remote Windows hosts by providing the NTLM hash instead of the plaintext password. Since the Linux server is compromised, the tester can extract hashes from memory or local files, then use psexec to execute commands over SMB via the ADMIN$ share. This is a direct lateral movement technique that does not require cracking, and it works against any Windows target that has NTLM authentication enabled.
- ✗
Kerberos Golden Ticket attack
Why it's wrong here
A Kerberos Golden Ticket attack requires forging a Ticket-Granting Ticket (TGT) using the KRBTGT account's hash, which is only accessible after fully compromising an Active Directory domain. This technique is used to create long-term persistence and unauthorized domain-wide access, not to authenticate to a single host with a captured user hash. To execute it, the tester would need Domain Admin privileges and access to the KRBTGT hash, making it entirely inappropriate for a simple pass-the-hash lateral movement scenario.
- ✗
SMB relay attack using the hash
Why it's wrong here
SMB relay attacks, as performed with tools like ntlmrelayx, intercept an authentication attempt and forward the challenge-response to another system, tricking it into accepting the attacker's credentials. This technique is valuable when an attacker is positioned to capture hashes in transit, but here the tester already possesses a valid NTLM hash, so relaying is unnecessary. Moreover, a relay attack requires an unsuspecting client to authenticate to the attacker's SMB server, which is not applicable when the tester directly controls the credential material.
- ✗
Brute-force password cracking of the hash
Why it's wrong here
Brute-force password cracking attempts to recover the plaintext password from the NTLM hash using offline tools like hashcat or John the Ripper, which is computationally expensive and may fail against complex passwords. While cracking could reveal reusable passwords, pass-the-hash already enables authentication without the plaintext, so the cracked password is not needed for lateral movement. The only scenario where cracking is justified is if the hash needs to be converted to a Kerberos AES key or used in a different protocol that does not support PtH, but for standard SMB access it is pointless.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Pass-the-hash
Pass-the-hash is a cyberattack where an attacker captures the hash of a user's password and uses it to authenticate to other systems without ever knowing the actual password.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.