A tester has captured a NetNTLMv2 hash using Responder. Which of the following commands will allow the tester to crack the hash using a mask attack?

The -r flag specifies a rule file for rule-based mutation of dictionary words, not a mask attack; this command performs a rule-based dictionary attack against the hash.

Mode -m 500 targets md5crypt/FreeBSD MD5 hashes rather than NetNTLMv2, and the command omits both an attack mode and any mask or wordlist, making it invalid for this scenario.

Hashcat flag -m 5600 targets NetNTLMv2 hashes specifically, -a 3 selects mask attack mode, and the mask ?a?a?a?a?a?a?a?a instructs hashcat to iterate all character classes across eight positions - together these three elements form the correct mask attack command for this hash type.

The -o flag only designates an output file for cracked results; without -a 3 and a mask pattern, this command defaults to a straight dictionary attack rather than a mask attack.