PT0-002 Vulnerability Discovery and Analysis Practice Question
A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?
⚠ Common exam trap
PT0-003 often tests the distinction between online brute-force tools (Hydra, Medusa) and offline crackers (Hashcat, John) — candidates pick John for GPU work, but Hashcat is the GPU-optimized choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashcat
Hashcat is purpose-built for offline password cracking and is optimized for GPU acceleration via OpenCL and CUDA, supporting NTLM hashes with modes like '-m 1000'. It scales across multiple GPUs and offers rule-based, mask, and combinator attacks, making it the standard tool for high-speed offline cracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Hashcat
Why this is correct
Hashcat performs offline hash cracking and supports GPU acceleration through OpenCL and CUDA, making it suited to NTLM hashes at high speed. It also handles NTLM format directly, unlike tools built for network capture or online authentication attacks.
- ✗
CrackMapExec
Why it's wrong here
CrackMapExec orchestrates lateral movement and hash spraying against live SMB and WinRM services across hosts; it neither loads NTLM hash files for offline recovery nor uses GPU acceleration. It suits enumerating and attacking reachable domain systems, not cracking captured hashes locally.
- ✗
John the Ripper
Why it's wrong here
John the Ripper's GPU support is limited and its NTLM handling is slower than dedicated alternatives, so it is not the strongest choice for GPU-accelerated offline cracking. It tempts because it is a long-established password cracker that does support NTLM hashes and OpenCL, just not optimally.
- ✗
Hydra
Why it's wrong here
Hydra performs online credential attacks against live network services such as SSH, FTP and HTTP forms; it cannot ingest NTLM hash files or exploit GPU parallelism for offline cracking. It would be the right pick for brute-forcing a login endpoint, not for recovering plaintext from captured hashes.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.