A penetration tester obtains a regular domain user's set of credentials. The tester wants to attempt a dictionary attack by creating a custom word list based on the Active Directory password policy…

The correct answer is B. CrackMapExec. This tool can query domain information over SMB/RPC using valid domain credentials, including retrieving the domain password policy (such as minimum length, complexity requirements, and lockout settings), which is useful for building a policy-aware custom wordlist for a…

Submitted by kevin_r· Mar 6, 2026Reconnaissance and enumeration

Question

A penetration tester obtains a regular domain user’s set of credentials. The tester wants to attempt a dictionary attack by creating a custom word list based on the Active Directory password policy. Which of the following tools should the penetration tester use to retrieve the password policy?

Options

AResponder
BCrackMapExec
CHydra
Dmsfvenom

How the community answered

(32 responses)

A
3% (1)
B
81% (26)
C
9% (3)
D
6% (2)

Explanation

This tool can query domain information over SMB/RPC using valid domain credentials, including retrieving the domain password policy (such as minimum length, complexity requirements, and lockout settings), which is useful for building a policy-aware custom wordlist for a dictionary

Topics

#Active Directory enumeration#password policy#CrackMapExec#post-exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice