SY0-701 · Question #158
An employee fell for a phishing scam, which allowed an attacker to gain access to a company PC. The attacker scraped the PC's memory to find other credentials. Without cracking these credentials…
The correct answer is D. Pass-the-hash. Unlike other credential theft attacks, a pass the hash attack does not require the attacker to know or crack the password to gain access to the system. Rather, it uses a stored version of the password to initiate a new session.
Question
An employee fell for a phishing scam, which allowed an attacker to gain access to a company PC. The attacker scraped the PC's memory to find other credentials. Without cracking these credentials, the attacker used them to move laterally through the corporate network. Which of the following describes this type of attack?
Options
- APrivilege escalation
- BBuffer overflow
- CSQL injection
- DPass-the-hash
How the community answered
(50 responses)- A4% (2)
- B2% (1)
- C12% (6)
- D82% (41)
Explanation
Unlike other credential theft attacks, a pass the hash attack does not require the attacker to know or crack the password to gain access to the system. Rather, it uses a stored version of the password to initiate a new session.
Community Discussion
No community discussion yet for this question.