Why obscure hashes in penetration testing screenshots?
A penetration tester is taking screen captures of hashes obtained from a domain controller. Which of the following BEST explains why the penetration tester should immediately obscure portions of the images before saving?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your understanding that obscuring sensitive data in screenshots is a confidentiality measure, not a way to hide the testing methodology or alter the hash appearance.
In the CompTIA PenTest+ PT0-002 exam, a question about obscuring hash screenshots from a domain controller tests the importance of maintaining confidentiality. The community unanimously agrees that the tester should immediately obscure image portions because hashes are sensitive information, and unauthorized disclosure could lead to compromise.
A common mistake is choosing B (to avoid disclosure of how the hashes were obtained) because testers may think obscuring hides the source. However, the primary reason is protecting the sensitive hash data itself, not the technique used.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is correct because hashes obtained from a domain controller are sensitive credentials material. If screenshots of these hashes were accidentally disclosed or accessed by unauthorized individuals, the organization could be at risk of compromise, as stated in comment [1]. The penetration tester must immediately obscure the hash values to maintain confidentiality—this aligns with the principle of protecting data at rest and in transit, even during an engagement. The data has already been seen by the tester, but obscuring the images prevents further exposure in case the files are leaked or shared without proper safeguards, as noted in comment [2].
Why the Other Options Are Wrong
Option B is incorrect because obscuring the hash values does not hide the method used to obtain them; the tester's actions, tools, and commands are what reveal the method, not the hash values themselves. Option C is incorrect because obscuring portions of an image does not make hashes shorter or easier to crack—that is nonsensical and would not affect the hash's actual length or cryptographic complexity. Option D is incorrect because the type of hash (e.g., NTLM, LM) is often identifiable by its format, and obscuring parts of the image would not prevent an analyst from inferring the hash type from the visible portion or the context of the capture.
Community Comment Notes
The commenters unanimously selected A, and their reasoning reinforces the confidentiality angle. Comment [1] explicitly states that hashes are sensitive information and that unauthorized access could put the organization at risk. Comment [2] adds a subtle nuance: the tester has already seen the data, but this does not weaken the need to protect the screenshots from broader disclosure. Together, these comments show that the best explanation is about data confidentiality, not process hiding or cosmetic alterations.
Official Reference
Exam Strategy
When answering 'BEST explains' questions, focus on the underlying security principle rather than surface-level details. For screenshot handling, always relate to confidentiality and data protection, and be wary of options that mention hiding the testing process—those are rarely the primary reason in an ethical hacking context.