mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has gained access to a…
A penetration tester has gained access to a Windows workstation and extracted NTLM password hashes. The tester wants to move laterally to a server that authenticates using NTLM. The tester does not have the plaintext passwords. Which technique is MOST appropriate to authenticate to the server using the captured hashes?
⚠ Common exam trap
Candidates often think they need the plaintext password for authentication and choose brute force or rainbow tables, not realizing that NTLM authentication accepts the hash directly in the challenge-response exchange, making pass-the-hash the most efficient lateral movement technique.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-the-hash
Pass-the-hash (PtH) is the correct technique because it allows the tester to authenticate to the remote server using the captured NTLM hash directly, without needing the plaintext password. NTLM authentication uses a challenge-response protocol where the hash itself is the secret; by presenting the hash in the response, the tester can impersonate the user. This is a well-known lateral movement technique in Windows environments, often executed with tools like Mimikatz (sekurlsa::pth) or Impacket's wmiexec.py.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pass-the-hash
Why this is correct
Pass-the-hash (PtH) is the optimal technique because the tester can extract the NTLM hash from the compromised workstation's memory (e.g., via Mimikatz) and use it to authenticate directly to remote services like SMB, RDP, or LDAP that accept NTLM authentication. This bypasses the need to crack the hash or know the plaintext password, allowing immediate lateral movement. PtH tools such as impacket's psexec.py or mimikatz's sekurlsa::pth facilitate this attack.
- ✗
Brute force
Why it's wrong here
Brute force attacks involve systematically guessing the plaintext password against a remote authentication service, which is both time-consuming and likely to trigger account lockout policies or intrusion detection. Since the tester already possesses a valid NTLM hash from the workstation, attempting to brute-force the cleartext password is redundant and introduces unnecessary noise. Moreover, modern password policies and rate-limiting make brute force impractical compared to the direct use of the hash.
- ✗
Rainbow tables
Why it's wrong here
Rainbow tables are precomputed tables that map hash values back to plaintext passwords, but they are used to crack a hash offline, not to authenticate directly. They require substantial disk storage and are largely ineffective against NTLM hashes that are salted or when the password is complex; even then, the process takes time and provides no advantage over using the captured hash itself. Since the goal is to authenticate to a remote service, applying the hash directly is faster and avoids the overhead of cracking.
- ✗
Keylogging
Why it's wrong here
Keylogging involves capturing keystrokes on the current workstation, which could reveal passwords as the user types them, but it does not leverage the already-extracted NTLM hash. For immediate authentication to a remote server using existing credentials, keylogging is passive and requires waiting for the user to enter a password, which is unreliable and slow. Additionally, keyloggers may miss credentials entered via credential prompts or other input methods, making PtH far more efficient for lateral movement.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Mimikatz
Mimikatz is a powerful open-source tool used by attackers and security professionals to extract plaintext passwords, hashes, PINs, and Kerberos tickets from Windows memory.
Key term
Pass-the-hash
Pass-the-hash is a cyberattack where an attacker captures the hash of a user's password and uses it to authenticate to other systems without ever knowing the actual password.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.