Exam SY0-701 topic 1 question 292 discussion

Actual exam question from CompTIA's SY0-701

Question #: 292
Topic #: 1

An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following:

PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com /ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327

Which of the following best describes how the attacker gained access to the hardened PC?

A. The attacker created fileless malware that was hosted by the banking platform.
B. The attacker performed a pass-the-hash attack using a shared support account.
C. The attacker utilized living-off-the-land binaries to evade endpoint detection and response software.
D. The attacker socially engineered the accountant into performing bad transfers.

Show Suggested Answer

Suggested Answer: B 🗳️

by Muhammad_Umair at Aug. 18, 2024, 10:32 a.m.

Comments

Submit Cancel

Muhammad_Umair

Highly Voted 6 months, 3 weeks ago

Mimikatz is an open-source tool that allows users to view and extract credentials stored on a Windows system. It can extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. Answer (B)

upvoted 7 times

...

01a4c2e

Most Recent 5 months ago

Selected Answer: B

B. The attacker performed a pass-the-hash attack using a shared support account. The command history indicates that the attacker used Mimikatz to perform a pass-the-hash (PTH) attack, which involves using a hashed password (NTLM hash) to authenticate without needing to know the plaintext password. This suggests that the attacker exploited the credentials of a local admin account to access the hardened PC.

upvoted 2 times

...

a4e15bd

6 months, 3 weeks ago

Selected Answer: B

B. is the correct answer.

upvoted 2 times

...