In a physical penetration testing scenario, the penetration tester obtains physical access to a laptop following as a potential NEXT step to extract credentials from the device?

Brute-forcing a user's password is generally an inefficient and time-consuming method when more direct and potent credential extraction techniques are available with physical access.

Performing an ARP spoofing attack focuses on redirecting network traffic, but it does not directly extract credentials from the target device itself or other devices as efficiently as poisoning methods.

Leveraging the BeEF framework is primarily for web browser exploitation and requires user interaction with a malicious web page, which is not the most direct or immediate credential extraction technique with physical access to a locked device.

With physical access to a laptop, a penetration tester can boot a specialized operating system or introduce a device to perform LLMNR/NETBIOS-ns poisoning. This technique involves impersonating network services to capture authentication hashes from other systems on the local network segment that query for names, effectively extracting credentials traversing the network.