mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: During an internal security assessment, a tester…
During an internal security assessment, a tester uses a tool to attempt to crack password hashes extracted from a domain controller. Which phase of the penetration testing process does this represent?
⚠ Common exam trap
It's easy for candidates to confuse post-exploitation with exploitation, mistakenly thinking that cracking hashes is part of the initial exploitation phase, when in fact exploitation is the act of gaining access, and post-exploitation includes all activities performed after that access is achieved.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-exploitation
C is correct because cracking password hashes extracted from a domain controller occurs after the tester has already gained access to the system. This activity is part of the post-exploitation phase, where the tester escalates privileges, extracts credentials, and moves laterally. In this context, the tester is using a tool like John the Ripper or Hashcat to crack NTLM hashes, which is a classic post-exploitation step to obtain plaintext passwords for further access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance is the initial phase of a security assessment where an attacker or tester gathers information about the target system or network without directly interacting with it in an intrusive way. This phase focuses on identifying potential vulnerabilities, network topology, services, and user information, typically through passive or active scanning, OSINT, or enumeration, but does not involve active password cracking which requires prior access.
- ✗
Reporting
Why it's wrong here
Reporting is the final phase of a security assessment or penetration test, where all findings, vulnerabilities, risks, and recommended remediation actions are documented and presented to the client or stakeholders. This phase synthesizes the results from all prior stages, including reconnaissance, exploitation, and post-exploitation, into a comprehensive report, and therefore does not involve the technical execution of password cracking.
- ✓
Post-exploitation
Why this is correct
Post-exploitation refers to the actions performed after initial access to a system has been successfully gained. This phase aims to escalate privileges, maintain persistence, pivot to other systems, and gather sensitive information, such as user credentials. Password cracking, often performed on collected hash files (e.g., from SAM database, /etc/shadow, or network traffic), is a common post-exploitation activity used to obtain plaintext passwords for further lateral movement or deeper system compromise.
- ✗
Exploitation
Why it's wrong here
Exploitation is the phase where an attacker or tester leverages a discovered vulnerability to gain initial unauthorized access to a target system or network. This involves executing a specific exploit code or technique to bypass security controls and establish a foothold, such as gaining a shell or executing arbitrary commands. Password cracking, however, typically occurs *after* this initial access has been established, using credentials or hashes obtained during the initial compromise.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Penetration testing
Penetration testing is a simulated cyberattack on a computer system, network, or application to find security weaknesses before real attackers can exploit them.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.