PEN-200 Active Directory Attacks Practice Question
You have captured an NTLM hash of a domain user. Why is performing a Pass-the-Hash (PtH) attack often more effective than attempting to crack the hash for the cleartext password?
⚠ Common exam trap
Candidates incorrectly believe cracking a hash is necessary to authenticate. In Windows NTLM authentication, the hash itself is treated as the proof of identity, rendering cracking unnecessary for successful login.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hash is accepted directly by the authentication service
Pass-the-Hash relies on the fact that Windows authentication protocols (NTLM) use the hash itself as a form of credential. By injecting the hash into the authentication process, the attacker can authenticate as the user without ever knowing the cleartext password. This bypasses complexity requirements and is immune to password cracking speeds, making it an extremely efficient method for lateral movement within a domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It requires less network traffic than a standard login
Why it's wrong here
Pass-the-Hash does not reduce network traffic significantly compared to a standard login. The efficiency of the attack comes from skipping the password-to-hash derivation process and avoiding the need to crack the hash offline, which is computationally expensive. Network traffic volume remains largely comparable to legitimate authentication requests.
- ✓
The hash is accepted directly by the authentication service
Why this is correct
NTLM authentication protocols authenticate using the NTLM hash directly. By providing the hash to the authentication process, the attacker can successfully impersonate the user without needing to crack the hash to reveal the cleartext password, making it an immediate and highly effective method for lateral movement.
- ✗
Cracking the hash is prohibited by corporate policy
Why it's wrong here
While policy is relevant in real-world engagements, the technical reason for preferring PtH is its reliability and speed. Cracking is technically possible and often done, but it is not guaranteed to succeed if the password is complex. PtH does not care about password complexity, making it technically superior for access.
- ✗
The hash provides access to all domain controllers
Why it's wrong here
A user's hash only provides the privileges associated with that specific user account. It does not automatically grant access to domain controllers unless the user account itself has those specific privileges. Pass-the-Hash is a method of authentication, not a vulnerability that grants elevated permissions to non-authorized domain assets.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.