PT0-002 Practice Question: During a penetration test, a tester has access to…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  SMB signing must be disabled or not enforced

  Why this is correct

  SMB signing must be disabled or not enforced. When SMB signing is enforced, every message is cryptographically signed using the session key derived from the NTLM handshake; a relayed authentication packet can be forwarded, but the subsequent signed traffic from the attacker cannot be validated by the target server because the attacker never learns the session key. If signing is disabled or only opt-in (not enforced), the server accepts unsigned messages, allowing the attacker to relay the authentication and then freely modify or inject SMB commands. Therefore, this is the primary technical condition that must exist for an NTLM relay to a Windows target to succeed.

• ✗

  The attacker must be on the same subnet

  Why it's wrong here

  The attacker must be on the same subnet. This is a common misconception because subnets make ARP poisoning or MAC flooding easier, but SMB relay only requires the attacker to be in the network path between the client and server. With proper IP routing, an attacker on a different subnet can use a phishing page or a man-in-the-middle technique to force the client to authenticate to an attacker-controlled SMB server, and then relay that authentication to the target system across routed networks. Since the relayed SMB packets carry the original client's credentials, the target sees them as coming from the authenticated client, regardless of the attacker's subnet.

• ✗

  The target must have a publicly available SMB share

  Why it's wrong here

  The target must have a publicly available SMB share. The attack does not depend on a file share being open to everyone; it only requires the target to listen on TCP port 445 and respond to an SMB negotiation request. Even if all shares are administrative and hidden (like C$ or IPC$), as long as the service accepts authentication, the relayed authentication can be used to establish a session, query the system, or execute commands via Windows services and scheduled tasks. Publicly available shares are irrelevant because the attacker is not trying to browse a folder; they are trying to use the authenticated identity to access system functionality.

• ✗

  The attacker must have admin privileges on the relay machine

  Why it's wrong here

  The attacker must have admin privileges on the relay machine. The relay machine is the system controlled by the attacker that runs tools such as ntlmrelayx or responder; these tools are simply network listeners and packet forwarders, which can be executed with the privileges of a normal user. Admin privileges are only required on the target side for certain post-relay actions (like accessing admin shares), not on the attacker's own machine. The authentication relay process itself runs entirely in user mode and does not install drivers, hooks, or kernel components, so elevated privileges on the relay host are unnecessary.

Go deeper

Related to this question