GCIH Understanding Passwords Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Directly decrypt the NTLM hashes using the Windows Data Protection API (DPAPI) to obtain cleartext passwords.

  Why it's wrong here

  This is incorrect. DPAPI is used to encrypt data such as stored credentials and is not a tool for decrypting NTLM hashes. NTLM hashes are one-way cryptographic representations and cannot be decrypted. DPAPI protects secrets like saved passwords in browsers or Windows Credential Manager, but it does not reverse hashes. An attacker would need to compromise the user's logon credentials or master keys to abuse DPAPI, which is a separate attack path.

• ✗

  Use the hashes to generate Kerberos golden tickets without any further privileges or domain compromise.

  Why it's wrong here

  This is false. Creating a Kerberos golden ticket requires the KRBTGT account hash, which is only available on domain controllers, not from a workstation's SAM database. The SAM contains local account hashes, not domain Kerberos keys. An attacker with only local hashes cannot forge golden tickets; they would need to escalate to domain admin and extract the KRBTGT hash. This option overstates the impact of local hash extraction.

• ✓

  Pass-the-hash to authenticate to other Windows systems using the NTLM hash without knowing the plaintext password.

  Why this is correct

  This is correct. Windows NTLM authentication accepts the hash as proof of identity in certain protocols, allowing an attacker to authenticate without cracking the hash. This technique, known as pass-the-hash, is a common lateral movement method. The attacker can use tools like Mimikatz or Impacket to inject the hash into a new session and access remote resources. It does not require the plaintext password, making it a direct threat once hashes are obtained.

• ✗

  Recover the original plaintext passwords by reversing the MD5 algorithm used to store them in the SAM database.

  Why it's wrong here

  This is incorrect. Windows does not store passwords in the SAM using MD5. It uses NTLM hashes, which are based on MD4 for the underlying hash, but the process is not reversible. Even if MD5 were used, cryptographic hash functions are one-way and cannot be reversed. The only way to recover plaintext is through cracking techniques like brute force or dictionary attacks, not by algorithmic reversal.

• ✓

  Offline brute-force or dictionary attacks against the NTLM hashes to recover plaintext passwords.

  Why this is correct

  This is correct. NTLM hashes are stored in the SAM and can be cracked offline using tools like Hashcat or John the Ripper. Unlike pass-the-hash, which uses the hash directly for authentication, offline cracking aims to recover the original password. Success depends on password complexity and the attacker's hardware. Once cracked, the plaintext can be reused for other systems, especially if password reuse is prevalent, broadening the attacker's access.