exam questions

Exam SY0-701 All Questions

View all questions & answers for the SY0-701 exam

Exam SY0-701 topic 1 question 292 discussion

Actual exam question from CompTIA's SY0-701
Question #: 292
Topic #: 1
[All SY0-701 Questions]

An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following:

PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com /ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327

Which of the following best describes how the attacker gained access to the hardened PC?

  • A. The attacker created fileless malware that was hosted by the banking platform.
  • B. The attacker performed a pass-the-hash attack using a shared support account.
  • C. The attacker utilized living-off-the-land binaries to evade endpoint detection and response software.
  • D. The attacker socially engineered the accountant into performing bad transfers.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Muhammad_Umair
Highly Voted 6 months, 3 weeks ago
Mimikatz is an open-source tool that allows users to view and extract credentials stored on a Windows system. It can extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. Answer (B)
upvoted 7 times
...
01a4c2e
Most Recent 4 months, 3 weeks ago
Selected Answer: B
B. The attacker performed a pass-the-hash attack using a shared support account. The command history indicates that the attacker used Mimikatz to perform a pass-the-hash (PTH) attack, which involves using a hashed password (NTLM hash) to authenticate without needing to know the plaintext password. This suggests that the attacker exploited the credentials of a local admin account to access the hardened PC.
upvoted 2 times
...
a4e15bd
6 months, 2 weeks ago
Selected Answer: B
B. is the correct answer.
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago