MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Pass-the-Hash (PtH) attack primarily involves stealing what type of credential?
   a. Plaintext password
   b. Password hash
   c. Encrypted file
   d. Biometric data
   Answer: b. Password hashbeyondtrust+1​
2. The Pass-the-Hash technique is most commonly associated with which platform?
   a. Linux systems
   b. macOS systems
   c. Windows systems
   d. Android systems
   Answer: c. Windows systemssemperis+1​
3. Which Windows authentication protocol is often exploited in Pass-the-Hash attacks?
   a. Kerberos only
   b. NTLM
   c. OAuth
   d. RADIUS
   Answer: b. NTLMtechtarget+1​
4. Which tool is widely used to perform Pass-the-Hash attacks by extracting hashes from memory?
   a. Nmap
   b. Mimikatz
   c. Wireshark
   d. Burp Suite
   Answer: b. Mimikatzstrongdm+1​
5. Pass-the-Hash attacks allow attackers to bypass what process?
   a. Password decryption
   b. Network isolation
   c. Multi-factor authentication
   d. Data encryption
   Answer: a. Password decryptionwhizlabs+1​
6. Which Windows database often stores hashed credentials targeted in PtH attacks?
   a. Active Directory Schema
   b. SAM (Security Account Manager)
   c. Registry Hive
   d. System Volume Information
   Answer: b. SAM (Security Account Manager)crowdstrike+1​
7. The main goal of a Pass-the-Hash attack is to:
   a. Crack encryption keys
   b. Gain unauthorized authentication
   c. Deny service to users
   d. Alter DNS records
   Answer: b. Gain unauthorized authenticationstrongdm+1​
8. What privilege does an attacker typically need to extract password hashes locally?
   a. Standard user
   b. Network guest
   c. Local administrator
   d. PowerShell console user
   Answer: c. Local administratorbeyondtrust+1​
9. Which protocol’s default Single Sign-On is vulnerable to PtH exploitation?
   a. SSO via NTLM
   b. SAML single sign-on
   c. OAuth SSO
   d. OpenID Connect
   Answer: a. SSO via NTLMbeyondtrust​
10. What is the first step in a Pass-the-Hash attack sequence?
    a. Extract hashes
    b. Gain initial access
    c. Disable authentication logs
    d. Create new user accounts
    Answer: b. Gain initial accesssemperis+1​
11. A tool like PsExec helps attackers in what phase of PtH?
    a. Hash extraction
    b. Hash passing
    c. Credential resetting
    d. Token cleanup
    Answer: b. Hash passingsemperis+1​
12. Pass-the-Ticket (PtT) differs from PtH by targeting what?
    a. NTLM passwords
    b. Kerberos tickets
    c. Database credentials
    d. Session cookies
    Answer: b. Kerberos ticketssentinelone+1​
13. Which log event combination helps detect Pass-the-Hash activity in Windows?
    a. Events 10, 4624, 4672
    b. Events 4016, 6005, 7000
    c. Events 1000, 8004, 1022
    d. Events 4625, 4768, 4769
    Answer: a. Events 10, 4624, 4672manageengine​
14. Which component is most at risk if local administrator passwords are reused across machines?
    a. Service accounts
    b. Domain credentials
    c. Network shares
    d. Antivirus logs
    Answer: b. Domain credentialsblackfog+1​
15. The hash extracted during a PtH attack is stored where on Windows?
    a. System32 directory
    b. Registry under SAM hive
    c. Documents folder
    d. Temp directory
    Answer: b. Registry under SAM hivesemperis​
16. A common defensive measure against PtH is implementing what principle?
    a. Least Privilege
    b. Default Deny
    c. Implicit Trust
    d. Full Privilege
    Answer: a. Least Privilegegeeksforgeeks+1​
17. Which of the following is a major cause enabling PtH attacks?
    a. Weak encryption algorithms
    b. Shared administrative credentials
    c. Insecure database schemas
    d. Cross-site scripting
    Answer: b. Shared administrative credentialsblackfog+1​
18. Lateral movement in network refers to:
    a. Transferring files between VMs
    b. Moving across systems via stolen credentials
    c. Remote desktop access through VPN
    d. DNS zone replication
    Answer: b. Moving across systems via stolen credentialsstrongdm+1​
19. Which type of authentication does PtH exploit?
    a. Hash-based authentication
    b. Token-based authentication
    c. Certificate authentication
    d. Passwordless authentication
    Answer: a. Hash-based authenticationtechtarget+1​
20. Disabling which authentication protocol can help minimize PtH attacks?
    a. NTLM
    b. Kerberos
    c. HTTPS
    d. SMB
    Answer: a. NTLMblackfog+1​
21. What type of data is reused by attackers in PtH?
    a. Session keys
    b. Password hashes
    c. Certificates
    d. Tokens
    Answer: b. Password hashesbeyondtrust+1​
22. Which Windows service stores cached credentials in memory?
    a. LSA (Local Security Authority)
    b. Winlogon
    c. Task Scheduler
    d. DNS Client
    Answer: a. LSA (Local Security Authority)strongdm+1​
23. Mimikatz primarily accesses which for hash extraction?
    a. Memory dumps
    b. Windows Registry
    c. COM services
    d. Group Policy
    Answer: a. Memory dumpssemperis+1​
24. Which best describes Pass-the-Hash attacks?
    a. Stealing and replaying password hashes for authentication
    b. Cracking hashes offline using dictionaries
    c. Intercepting credentials in transit
    d. Logging keystrokes remotely
    Answer: a. Stealing and replaying password hashes for authenticationtechtarget+1​
25. Which entity publishes Event ID 4624 for logons?
    a. Sysmon
    b. Windows Security Log
    c. Application Log
    d. System Log
    Answer: b. Windows Security Logmanageengine​
26. Which cybersecurity concept reduces PtH risk by verifying each request independently?
    a. Zero Trust
    b. Access Control Lists
    c. Static Routing
    d. Logging-only model
    Answer: a. Zero Trustblackfog​
27. What privilege escalation goal might attackers pursue with PtH?
    a. Domain Admin access
    b. Local user account creation
    c. File write permission on temp folder
    d. Remote print service
    Answer: a. Domain Admin accesscrowdstrike+1​
28. Event ID 10 in Sysmon indicates what during PtH detection?
    a. A process accessed another process
    b. A new service was created
    c. A logon failed
    d. An account was locked
    Answer: a. A process accessed another processmanageengine​
29. How do attackers typically harvest password hashes?
    a. Dumping SAM or system memory
    b. Reading browser cookies
    c. Spoofing DNS records
    d. Phishing for text passwords
    Answer: a. Dumping SAM or system memorycrowdstrike+1​
30. What kind of attack is a Pass-the-Hash most similar to conceptually?
    a. Replay attack
    b. DDoS
    c. SQL Injection
    d. Ransomware
    Answer: a. Replay attackwhizlabs​
31. Which command-line tool can be leveraged to utilize hashes directly for remote execution?
    a. PsExec
    b. Ncat
    c. Netsh
    d. Powercfg
    Answer: a. PsExecstrongdm+1​
32. Which tool can legitimately detect PtH through event correlation?
    a. Log360
    b. Wireshark
    c. OpenSSL
    d. Cain & Abel
    Answer: a. Log360manageengine​
33. Cain & Abel is commonly used for:
    a. Password recovery and hash extraction
    b. Network scanning
    c. DNS spoofing
    d. File encryption
    Answer: a. Password recovery and hash extractionstrongdm​
34. The PtH attack generally follows which sequence?
    a. Access – Extract – Pass – Escalate
    b. Pass – Extract – Report – Audit
    c. Block – Authenticate – Reset – Verify
    d. Encrypt – Hash – Send – Log
    Answer: a. Access – Extract – Pass – Escalatesemperis+1​
35. Privilege escalation in PtH is achieved by:
    a. Reusing higher-privilege account hashes
    b. Brute-forcing system passwords
    c. Stealing SSL certificates
    d. Modifying ACLs directly
    Answer: a. Reusing higher-privilege account hashessemperis​
36. A secured system should avoid using identical local admin passwords to prevent:
    a. Cross-system PtH spread
    b. Log deletion
    c. Public key compromise
    d. USB-based spread
    Answer: a. Cross-system PtH spreadblackfog​
37. Which principle of authentication does PtH exploit?
    a. Hash reuse
    b. Multi-factor validation
    c. Private key rotation
    d. Password expiration
    Answer: a. Hash reusetechtarget+1​
38. One advanced defense mechanism against PtH is:
    a. Credential Guard
    b. Telnet Access Limit
    c. Registry Backup
    d. Account Mirroring
    Answer: a. Credential Guardblackfog​
39. Default NTLM authentication uses which kind of challenge structure?
    a. Challenge-response
    b. AES stream
    c. Diffie-Hellman
    d. Hash-table lookup
    Answer: a. Challenge-responsetechtarget​
40. Phishing often acts as an entry point for PtH because:
    a. It tricks users into installing malware to steal hashes
    b. It disables antivirus services
    c. It deletes log events
    d. It re-encrypts NTLM
    Answer: a. It tricks users into installing malware to steal hashescrowdstrike​
41. Which event ID signals special privileges assigned to a new logon?
    a. 4672
    b. 4625
    c. 4688
    d. 5100
    Answer: a. 4672manageengine​
42. Pass-the-Hash ultimately violates which security principle?
    a. Authentication integrity
    b. Confidentiality
    c. Availability
    d. Antiforensics
    Answer: a. Authentication integritytechtarget+1​
43. What is the difference between PtH and credential dumping?
    a. PtH uses hashes for reuse, not cracking
    b. PtH always targets domain controllers
    c. PtH requires plaintext passwords
    d. PtH alters encryption algorithms
    Answer: a. PtH uses hashes for reuse, not crackingbeyondtrust+1​
44. A PtH attack is successful if:
    a. The reused hash matches stored value
    b. The attacker decrypts the password
    c. The certificate chain is altered
    d. The SAM is erased
    Answer: a. The reused hash matches stored valuetechtarget+1​
45. Kerberos mitigates PtH risk by using:
    a. Ticket-based authentication
    b. Weak password reuse
    c. LSA memory dumps
    d. Static NTLM hashes
    Answer: a. Ticket-based authenticationsentinelone+1​
46. A common penetration testing framework supporting PtH simulation is:
    a. Metasploit
    b. Burp Suite
    c. Snort
    d. ClamAV
    Answer: a. Metasploitstrongdm​
47. Which operating system component should disable NTLM use?
    a. Group Policy settings
    b. Windows Defender
    c. SMB compression service
    d. LSASS logging
    Answer: a. Group Policy settingsblackfog​
48. Event correlation in SIEM tools is vital because it:
    a. Detects behavior patterns linked with PtH
    b. Encrypts logs automatically
    c. Deletes redundant user events
    d. Isolates network drives
    Answer: a. Detects behavior patterns linked with PtHnetwrix+1​
49. A clear indicator of PtH on a network is:
    a. Multiple logons from different systems with identical hashes
    b. Increased traffic on port 53
    c. System clock desynchronization
    d. Frequent DNS cache failures
    Answer: a. Multiple logons from different systems with identical hashesnetwrix​
50. The ultimate goal of a PtH attacker is to:
    a. Gain persistent network control
    b. Reset all user accounts
    c. Corrupt OS kernels
    d. Overwrite security logs
    Answer: a. Gain persistent network controlgeeksforgeeks+2​

1. https://www.beyondtrust.com/resources/glossary/pass-the-hash-pth-attack
2. https://www.techtarget.com/searchsecurity/definition/pass-the-hash-attack
3. https://www.semperis.com/blog/how-to-defend-against-pass-the-hash-attack/
4. https://www.strongdm.com/what-is/pass-the-hash-attack-pth
5. https://www.whizlabs.com/blog/comptia-security-certification-exam-questions/
6. https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/pass-the-hash-attack/
7. https://www.sentinelone.com/cybersecurity-101/threat-intelligence/what-are-pass-the-hash-pth-pass-the-ticket-ptt/
8. https://www.manageengine.com/products/eventlog/cyber-security/pass-the-hash-attack.html
9. https://www.blackfog.com/pass-the-hash-attacks-how-to-stop-them/
10. https://www.geeksforgeeks.org/ethical-hacking/pass-the-hash-pth-attack/
11. https://netwrix.com/en/resources/blog/how-to-detect-pass-the-hash-attacks/
12. https://www.sanfoundry.com/cryptography-questions-answers-hash-functions/
13. https://testbook.com/objective-questions/mcq-on-cyber-security-and-emerging-technologies–5eea6a0d39140f30f369e309
14. https://www.sanfoundry.com/1000-cyber-security-questions-answers/
15. https://letsfindcourse.com/blockchain-mcq/hashing-mcq-questions-and-answers
16. https://examradar.com/password-attacks-on-authentication-in-web-security-mcqs/
17. https://www.scribd.com/document/913538424/Cyber-Mcq
18. https://www.vinsys.com/blog/top-30-mcqs-ceh-exam-preparation
19. https://www.semperis.com/blog/pass-the-hash-attack-explained/
20. https://www.studocu.com/in/document/lovely-professional-university/penetration-testing/mcq-mcq/78126564