Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

A company has deployed Microsoft Defender for Identity and wants to detect pass-the-hash attacks in real time. Which alert type should they monitor?

⚠ Common exam trap

Many candidates confuse pass-the-hash with Kerberoasting or Golden Ticket attacks, but the key differentiator is that pass-the-hash relies on NTLM hash reuse in real time, while the others involve Kerberos ticket manipulation or offline cracking.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Suspected Pass-the-Hash attack

Microsoft Defender for Identity specifically detects pass-the-hash attacks by monitoring anomalous NTLM authentication patterns, such as the use of hashed credentials from one machine to authenticate to another. The 'Suspected Pass-the-Hash attack' alert is triggered when Defender for Identity identifies a hash being reused across multiple devices in a way that indicates lateral movement, which is the core behavior of a pass-the-hash attack.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Suspected Kerberoasting attack
Why it's wrong here
A Kerberoasting attack targets service accounts (SPNs) to obtain their NTLM hash, which can then be cracked offline to reveal the plaintext password. This attack involves requesting Kerberos service tickets for SPNs and then attempting to crack the encrypted ticket-granting service (TGS) portion. It specifically exploits weaknesses in service principal name (SPN) registration and weak service account passwords, aiming to gain credentials for services rather than directly reusing a user's NTLM hash for authentication.
✗
Suspected Brute Force attack
Why it's wrong here
A Brute Force attack involves systematically trying numerous password combinations against a target account until the correct one is discovered. This typically manifests as a high volume of failed login attempts from a specific source IP address or against a particular user account within a short timeframe. While Microsoft Defender for Identity can detect brute force attempts, this attack method focuses on guessing passwords rather than leveraging a stolen hash for authentication without knowing the password.
✓
Suspected Pass-the-Hash attack
Why this is correct
A Suspected Pass-the-Hash (PtH) attack involves an attacker authenticating to a remote system or service by directly using a user's NTLM hash, without ever needing to know the plaintext password. Microsoft Defender for Identity excels at detecting PtH by analyzing NTLM authentication traffic for anomalies, such as a user authenticating from a new source IP address or to a resource without a corresponding Kerberos pre-authentication. This technique bypasses traditional password-based authentication mechanisms, making it a critical threat for MDI to identify.
✗
Suspected Golden Ticket attack
Why it's wrong here
A Golden Ticket attack is a sophisticated post-exploitation technique where an attacker, having compromised the KRBTGT account hash (the Kerberos Ticket Granting Ticket account), forges a Kerberos Ticket Granting Ticket (TGT). This forged TGT grants the attacker unlimited access to any resource in the domain, effectively impersonating any user, including domain administrators, for an extended period. This attack specifically manipulates the Kerberos authentication protocol by creating illegitimate tickets, rather than reusing an NTLM hash for direct authentication.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Why each option matters

Option-by-option breakdown

Related to this question