PT0-002 Vulnerability Discovery and Analysis Practice Question
A penetration tester is performing a password cracking task against a dump of NTLM hashes obtained from a Windows domain controller. Which tool would be the most efficient for this task?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashcat
Hashcat is a GPU-accelerated password cracker that can crack NTLM hashes quickly, especially with a good wordlist and rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hydra
Why it's wrong here
Hydra performs network authentication attacks against live services (SSH, RDP, HTTP) by trying username/password combinations. It cannot parse a captured NTLM hash file and crack it offline; it needs a target service to attack. Thus, for a password cracking task on already obtained hashes, Hydra is unsuitable.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a versatile offline hash cracker supporting many formats, including NTLM, and can run in CPU-only mode. However, its performance on NTLM hashes is typically inferior to Hashcat, which leverages GPU acceleration and optimized kernels for fast NTLM cracking. So while John would work, Hashcat is the better choice.
- ✓
Hashcat
Why this is correct
Hashcat is the industry-standard for offline hash cracking, supporting GPU (CUDA/OpenCL) acceleration and highly optimized kernels for NTLM (mode 1000). It offers exhaustive rule-based attack modes, mask attacks, and support for pass-the-hash style hashes. For a penetration tester wanting the fastest NTLM cracking, Hashcat is the correct tool.
- ✗
CrackMapExec
Why it's wrong here
CrackMapExec (CME) is a post-exploitation framework for automating SMB, WMI, and WinRM attacks, including spraying creds and dumping SAM databases. It does not perform offline hash cracking; it uses hashes for authentication (pass-the-hash) but cannot recover the plaintext password. Therefore, it is irrelevant to a pure password cracking task.
Go deeper
Related to this question
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.