Which attack used Mimikatz and an NTLM hash to access hardened PC?

SY0-701 By islever Editorial Last updated

Short answer

B The attacker performed a pass-the-hash attack using a shared support account.

Question

An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following: PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com /ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327 Which of the following best describes how the attacker gained access to the hardened PC?
  1. The attacker created fileless malware that was hosted by the banking platform.
  2. The attacker performed a pass-the-hash attack using a shared support account. Correct Answer
  3. The attacker utilized living-off-the-land binaries to evade endpoint detection and response software.
  4. The attacker socially engineered the accountant into performing bad transfers.

Key Takeaways

The question tests identification of credential reuse attacks; the trap is overlooking that the NTLM hash in the Mimikatz command enables pass-the-hash, not fileless or LOLBin techniques.

A pass-the-hash attack with Mimikatz let the attacker authenticate as a shared support account using a captured NTLM hash. Community consensus confirms option B is correct.

Common mistake: Option C (living-off-the-land binaries) is a common wrong choice because it sounds evasive, but Mimikatz is a standalone tool, not a LOLBin; the hash reuse is the key indicator.

Expert Analysis

Why the Answer Is Correct

The command line shows Mimikatz using sekurlsa::pth, which performs a pass-the-hash attack by injecting an NTLM hash into an authentication token. This allows the attacker to impersonate the localadmin account without knowing the plaintext password, exactly as described in option B. Commenter [1] notes Mimikatz extracts credentials from memory, and [2] explains that PTH uses a hashed password to authenticate.

Why the Other Options Are Wrong

Option A is unlikely because the attack uses on-premises credential theft, not fileless malware hosted by the banking platform. Option C is incorrect because Mimikatz is not a living-off-the-land binary; it is an external tool. Option D is plausible but not supported by the evidence, which shows a technical credential attack rather than social engineering.

Community Comment Notes

All community comments agree on answer B, with the highest-liked comment (7 likes) defining Mimikatz and its credential-extraction capabilities. Another comment highlights that the NTLM hash in the command is the key evidence for pass-the-hash. No dissenting opinions were provided.

Official Reference

https://attack.mitre.org/techniques/T1550/002/

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing attack timelines, map each command to its MITRE ATT&CK technique. Here, sekurlsa::pth is a clear indicator of pass-the-hash; rule out options that mention other threat categories or untargeted techniques.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Muhammad_Umair 👍 7
    Mimikatz is an open-source tool that allows users to view and extract credentials stored on a Windows system. It can extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. Answer (B)
  2. 01a4c2e 👍 2 Answered B
    B. The attacker performed a pass-the-hash attack using a shared support account. The command history indicates that the attacker used Mimikatz to perform a pass-the-hash (PTH) attack, which involves using a hashed password (NTLM hash) to authenticate without needing to know the plaintext password. This suggests that the attacker exploited the credentials of a local admin account to access the hardened PC.
  3. a4e15bd 👍 2 Answered B
    B. is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide