CEH Enumeration and System Hacking Practice Question
A penetration tester uses the following command to extract the contents of a SAM file: 'samdump2 SYSTEM /mnt/windows/Windows/System32/config/SAM'. What is the primary purpose of this action?
⚠ Common exam trap
Many candidates confuse the purpose of dumping hashes (offline cracking) with the subsequent attack technique (pass-the-hash), but the question asks for the primary purpose of the `samdump2` command itself, which is hash extraction for cracking, not immediate authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To capture NTLM hashes for offline cracking
The `samdump2` tool extracts password hash data from the SAM (Security Account Manager) registry hive file. By providing the SYSTEM hive (which contains the boot key) and the SAM file, the tool decrypts and dumps the NTLM hashes of local user accounts. These hashes can then be used in offline cracking attacks (e.g., with John the Ripper or Hashcat) to recover plaintext passwords, making option C correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To escalate privileges on the system
Why it's wrong here
This command extracts credential hashes, which are valuable *after* initial access and often *after* some form of privilege escalation has already occurred to gain the necessary permissions to access the SAM database or LSASS memory. The act of extracting hashes itself is not the privilege escalation, but rather a post-exploitation step to gather credentials that *can be used* for further lateral movement or higher privilege access on the system.
- ✗
To enumerate users via LDAP
Why it's wrong here
The command in question is designed to extract local system password hashes, typically from the Security Account Manager (SAM) database or the Local Security Authority Subsystem Service (LSASS) memory. This process is distinct from enumerating users via LDAP, which involves querying a directory service for user accounts, groups, and attributes using protocols like LDAP, often with tools like `ldapsearch` or `ADExplorer`.
- ✓
To capture NTLM hashes for offline cracking
Why this is correct
This command's primary purpose is to extract NTLM password hashes from a compromised Windows system, typically targeting the Security Account Manager (SAM) database or the Local Security Authority Subsystem Service (LSASS) memory. Once extracted, these hashes can be transferred to an attacker-controlled machine for offline cracking using tools like Hashcat or John the Ripper. Offline cracking allows for brute-force or dictionary attacks without directly interacting with the target system, reducing detection risk and computational burden on the victim.
- ✗
To perform a pass-the-hash attack
Why it's wrong here
While the NTLM hashes extracted by this command are essential prerequisites for a pass-the-hash (PtH) attack, the command itself is solely responsible for the *extraction* of those hashes. A pass-the-hash attack is a subsequent post-exploitation technique where the captured hash is directly used to authenticate to other network services or systems without needing to recover the plaintext password, leveraging the hash's validity for authentication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.