GPEN Advanced Password Attacks Practice Question
A penetration tester has obtained a single NT hash for a domain user account during an internal engagement. The tester wants to authenticate to a remote Windows 10 workstation as that user without knowing the plaintext password. Which tool is designed to perform this authentication using only the NT hash?
⚠ Common exam trap
Watch out — candidates often confuse tools that capture hashes with tools that use hashes to authenticate; Pass-the-Hash requires injecting the hash into a logon session, not just possessing it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mimikatz with the sekurlsa::pth module
Pass-the-Hash uses the NT hash itself as the credential to authenticate to remote systems. Mimikatz's sekurlsa::pth module injects the hash into a new logon session, enabling the tester to access resources as the target user without recovering the plaintext password. Other tools listed perform different functions such as poisoning, enumeration, or online brute-force, and cannot authenticate with an NT hash.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Responder with the -w flag
Why it's wrong here
Responder is used to poison LLMNR, NBT-NS, and mDNS to capture NetNTLM hashes, not to authenticate using an NT hash. Its -w flag enables the WPAD proxy server, which is unrelated to Pass-the-Hash authentication. It does not perform remote authentication with captured hashes.
- ✗
Hydra with the -H option
Why it's wrong here
Hydra is an online password-cracking tool that attempts plaintext passwords against network services. Its -H option specifies a header file, not an NT hash for authentication. Hydra does not support Pass-the-Hash because it relies on password-based logins, not hash injection.
- ✗
Nmap with the smb-enum-users script
Why it's wrong here
Nmap's smb-enum-users script enumerates user accounts via SMB, but it does not perform authentication using an NT hash. It is used for reconnaissance, not for Pass-the-Hash. This tool cannot authenticate to a remote workstation as the target user.
- ✓
Mimikatz with the sekurlsa::pth module
Why this is correct
Mimikatz's sekurlsa::pth module performs Pass-the-Hash by injecting the NT hash into a new logon session, allowing authentication to remote systems without the plaintext password. It is a standard tool for this scenario in internal penetration tests.
About these practice questions
Courseiva writes every GPEN question from scratch — 298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.