CEH Vulnerability Analysis and System Hacking Practice Question
Exhibit
c:\) hashcat -m 1000 -a 0 hashes.txt wordlist.txt --show $1$abc$12345:password $5$xyz$67890:qwerty $6$def$11111:letmein $2y$10$abcdefg:hunter2 c:\) hashcat -m 1000 -a 0 hashes.txt wordlist.txt --potfile-disable
Refer to the exhibit. A penetration tester runs hashcat to crack NTLM hashes. Which hash mode (-m) would be correct for NTLM?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1000
NTLM hash mode is 1000. The exhibit shows -m 1000, which is correct for NTLM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
1100
Why it's wrong here
Hashcat mode 1100 is specifically for cracking Domain Cached Credentials (DCC), also known as MS-CHAPv2 or NT Cached Hashes (DCC2). These hashes are derived from a user's NTLM hash but are stored locally on a domain-joined machine for offline authentication purposes. This mode is distinct from cracking raw NTLM hashes, which are typically extracted directly from the SAM database or NTDS.DIT.
- ✓
1000
Why this is correct
Hashcat mode 1000 is the correct and standard choice for cracking NTLM (NT LAN Manager) hashes, which are the cryptographic one-way functions of a user's password used for authentication in Windows environments. These hashes are commonly extracted from the Security Account Manager (SAM) database, Active Directory's NTDS.DIT file, or captured via various network protocols. This mode directly targets the NTLM hash format, making it ideal for direct password recovery from stored hashes.
- ✗
3000
Why it's wrong here
Hashcat mode 3000 is designated for cracking LM (LAN Manager) hashes, an older and significantly weaker password hashing algorithm used in legacy Windows systems. LM hashes are highly vulnerable due to their fixed-length blocks, case-insensitivity, and lack of salting, making them susceptible to rapid dictionary and rainbow table attacks. Modern Windows systems primarily use NTLM and Kerberos, rendering LM hashes largely obsolete in contemporary environments.
- ✗
5500
Why it's wrong here
Hashcat mode 5500 is specifically designed for cracking NetNTLMv1 hashes, which are challenge-response hashes captured from network authentication attempts, often via tools like Responder. These hashes represent the NTLMv1 challenge-response mechanism, where a server sends a challenge and the client responds with a hash derived from that challenge and the user's NTLM password hash. While related to NTLM, NetNTLMv1 is a network-captured format distinct from the raw NTLM password hash stored in local or domain databases.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.