Why obscure hashes in penetration testing screenshots?

PT0-002 By islever Editorial Last updated

Short answer

A To maintain confidentiality of data/information

Question

A penetration tester is taking screen captures of hashes obtained from a domain controller. Which of the following BEST explains why the penetration tester should immediately obscure portions of the images before saving?
  1. To maintain confidentiality of data/information Correct Answer
  2. To avoid disclosure of how the hashes were obtained
  3. To make the hashes appear shorter and easier to crack
  4. To prevent analysis based on the type of hash

Key Takeaways

The question tests your understanding that obscuring sensitive data in screenshots is a confidentiality measure, not a way to hide the testing methodology or alter the hash appearance.

In the CompTIA PenTest+ PT0-002 exam, a question about obscuring hash screenshots from a domain controller tests the importance of maintaining confidentiality. The community unanimously agrees that the tester should immediately obscure image portions because hashes are sensitive information, and unauthorized disclosure could lead to compromise.

Common mistake: A common mistake is choosing B (to avoid disclosure of how the hashes were obtained) because testers may think obscuring hides the source. However, the primary reason is protecting the sensitive hash data itself, not the technique used.

Expert Analysis

Why the Answer Is Correct

Option A is correct because hashes obtained from a domain controller are sensitive credentials material. If screenshots of these hashes were accidentally disclosed or accessed by unauthorized individuals, the organization could be at risk of compromise, as stated in comment [1]. The penetration tester must immediately obscure the hash values to maintain confidentiality—this aligns with the principle of protecting data at rest and in transit, even during an engagement. The data has already been seen by the tester, but obscuring the images prevents further exposure in case the files are leaked or shared without proper safeguards, as noted in comment [2].

Why the Other Options Are Wrong

Option B is incorrect because obscuring the hash values does not hide the method used to obtain them; the tester's actions, tools, and commands are what reveal the method, not the hash values themselves. Option C is incorrect because obscuring portions of an image does not make hashes shorter or easier to crack—that is nonsensical and would not affect the hash's actual length or cryptographic complexity. Option D is incorrect because the type of hash (e.g., NTLM, LM) is often identifiable by its format, and obscuring parts of the image would not prevent an analyst from inferring the hash type from the visible portion or the context of the capture.

Community Comment Notes

The commenters unanimously selected A, and their reasoning reinforces the confidentiality angle. Comment [1] explicitly states that hashes are sensitive information and that unauthorized access could put the organization at risk. Comment [2] adds a subtle nuance: the tester has already seen the data, but this does not weaken the need to protect the screenshots from broader disclosure. Together, these comments show that the best explanation is about data confidentiality, not process hiding or cosmetic alterations.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When answering 'BEST explains' questions, focus on the underlying security principle rather than surface-level details. For screenshot handling, always relate to confidentiality and data protection, and be wary of options that mention hiding the testing process—those are rarely the primary reason in an ethical hacking context.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Vslaugh 👍 1 Answered A
    A - Hashes are sensitive information, if the images were accidentally disclosed or accessed by unauthorized individuals, the organization could be at risk of compromise.
  2. Nikamy 👍 1 Answered A
    A little tricky. The data has been already been seen by the tester.. tho... Hmm
  3. mat22 👍 1
    Answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide