Host-Based Attacks PT0-003 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary advantage of DLL injection for an attacker?

   • AIt allows code to run with the privileges of the target process
   • BIt allows the attacker to hide the DLL from the file system
   • CIt allows the attacker to bypass the need for authentication
   • DIt allows the attacker to encrypt network traffic
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common technique used to extract credentials from a Windows host?

   • ADumping the SAM database
   • BUsing the 'net user' command
   • CReading the /etc/shadow file
   • DUsing the 'passwd' command
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is using Mimikatz on a Windows 10 host to dump credentials. The tester runs 'privilege::debug' and then 'sekurlsa::logonpasswords', but the output does not show any plaintext passwords. Which reason best explains this?

   • AWindows Defender Credential Guard is enabled
   • BThe host is running Windows 10 version 1607 or later
   • CThe tester does not have administrative privileges
   • DThe tester is using the wrong Mimikatz module
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which tool is specifically designed to extract credentials from Windows memory, including plaintext passwords, hashes, and Kerberos tickets?

   • AJohn the Ripper
   • BWireshark
   • CMimikatz
   • DNmap
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of bypassing security mechanisms like antivirus or EDR during privilege escalation?

   • ATo encrypt the malicious payload
   • BTo increase the speed of the attack
   • CTo gain network access to other hosts
   • DTo avoid detection while executing malicious code
   Reveal Solution Discussion Select an answer first