PEN-200 Password Attacks Practice Question
You have obtained a copy of a Windows SAM file from a compromised host. You want to extract the NTLM hashes for offline cracking. Which of the following tools is specifically designed for this task?
⚠ Common exam trap
The trap here is assuming that any credential dumping tool can handle an offline SAM file, when some tools are designed for live memory extraction or network attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
secretsdump.py
Extracting NTLM hashes from a SAM file is a common post-exploitation step. secretsdump.py from Impacket is specifically built to parse SAM, SYSTEM, and other registry hives to recover local account hashes. Mimikatz focuses on memory extraction, Responder captures network traffic, and Hydra performs online brute force. Therefore, secretsdump.py is the correct tool for offline SAM parsing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
secretsdump.py
Why this is correct
secretsdump.py, part of Impacket, is designed to extract secrets from Windows systems, including SAM files, LSA secrets, and NTDS.dit. It can parse a standalone SAM file and output NTLM hashes for offline cracking. This makes it the appropriate tool for the task described.
- ✗
Mimikatz
Why it's wrong here
Mimikatz is used to extract plaintext passwords, hashes, and Kerberos tickets from memory, not from an offline SAM file. While it can dump hashes from a live system, it is not the primary tool for parsing a standalone SAM file. Thus, it is not the best choice for this scenario.
- ✗
Responder
Why it's wrong here
Responder is used to capture network authentication attempts by poisoning name resolution protocols. It does not extract hashes from a SAM file. Its purpose is to intercept credentials over the network, not to parse local files, so it is not suitable here.
- ✗
Hydra
Why it's wrong here
Hydra is an online password brute-forcing tool that attacks network services like SSH, FTP, and HTTP. It does not extract or parse hashes from a SAM file. Using Hydra would require a live service to attack, which is not the case when you have an offline SAM file.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.