PEN-200 Password Attacks Practice Question
During an internal penetration test, you obtain an NTDS.dit file and the associated SYSTEM registry hive. You need to crack the NTLM password hashes extracted from these files using Hashcat. Which command-line argument correctly specifies the hash type for standard Windows NTLM hashes?
⚠ Common exam trap
Candidates frequently confuse NTLM mode 1000 with NetNTLMv2 challenge-response mode 5600, wasting valuable attack time by supplying the wrong hash algorithm flag to Hashcat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
hashcat -m 1000 -a 0 hashes.txt wordlist.txt
Hashcat mode 1000 specifically targets Windows NTLM password hashes extracted from Active Directory or SAM databases. Specifying the correct hash mode is essential because Hashcat uses specialized algorithms and optimization routines tailored to the exact cryptographic structure of each supported hash format during the attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
hashcat -m 0 -a 0 hashes.txt wordlist.txt
Why it's wrong here
Mode 0 is exclusively reserved for cracking raw MD5 hashes rather than Windows NTLM password hashes extracted from the NTDS.dit database file. Using this mode will result in zero successful password recoveries because the underlying cryptographic validation routines are completely mismatched.
- ✗
hashcat -m 5600 -a 0 hashes.txt wordlist.txt
Why it's wrong here
Mode 5600 is utilized for cracking NetNTLMv2 hashes captured during network authentication negotiations, not stored NTLM hashes extracted from SAM or NTDS.dit files. Providing stored database hashes to this mode causes Hashcat to fail parsing the input format entirely.
- ✓
hashcat -m 1000 -a 0 hashes.txt wordlist.txt
Why this is correct
Mode 1000 directs Hashcat to target NTLM hashes, which matches the format of password hashes dumped directly from the Windows NTDS.dit database. Combining this mode with attack mode 0 enables a standard dictionary attack using your specified wordlist against the collected credentials.
- ✗
hashcat -m 3000 -a 0 hashes.txt wordlist.txt
Why it's wrong here
Mode 3000 targets LanMan hashes, an extremely outdated and insecure Windows password hashing mechanism deprecated since Windows NT. Modern Active Directory environments store NTLM hashes instead, rendering this legacy mode ineffective against current NTDS.dit extractions.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.