A security administrator recently reset local passwords and the following values were recorded in the system:
Which of the following is the security administrator most likely protecting against?
Exam SY0-601 All QuestionsBrowse all questions from this exam
Question 824
Correct Answer: C
The security administrator is most likely protecting against pass-the-hash attacks. In pass-the-hash attacks, an attacker can use a stolen hashed password to authenticate to a system without needing to decrypt it. By resetting the local passwords and generating new hashed values, the administrator invalidates any previously stolen hashes, thereby mitigating the risk that attackers can use those old hashes to gain unauthorized access.
Discussion
johnabayotOption: C
C. Pass the hash attack By resetting the local passwords, the security administrator is changing the hash values of the passwords, which invalidates any previously stolen hashes. This prevents the attacker from using the old hashes to access the system or move laterally across the network. Resetting the local passwords does not protect against password compromise, unless the administrator also ensures that the passwords are stored securely, transmitted over encrypted channels, and protected from phishing or keylogging attacks.
7308365Option: D
D. Password compromise I think they are just resetting the passwords based on time. All of the accounts are admin accounts so I'm assuming they have admins reset their accounts more frequently than other users. In this situation, the fact that the passwords are hashed doesn't matter because there are programs to crack the hash and changing the hash more frequently doesn't make it any easier/harder for the software to crack said hash... Lack of access to the actual hashes makes pass-the-hash attacks harder.
licks0reOption: D
Is that a protection against pass hash because the passwords are stored in hash format ? I dont think so.. I would go D.
DrakeMallardOption: C
C. Pass-the-hash attacks Pass-the-hash attacks involve an attacker obtaining hashed passwords from a compromised system and then using those hashes to authenticate to other systems on the network. The use of MD5 hashed passwords (as seen in the provided values) can be vulnerable to pass-the-hash attacks because once the hash is obtained, it can potentially be used to authenticate without needing to crack the password itself. By resetting the local passwords and recording new hashed values, the security administrator is likely aiming to mitigate the risk of pass-the-hash attacks by ensuring that even if an attacker obtains hashed passwords, they will be unable to use them for unauthorized access.
BenrosanOption: D
Seems like a password compromise. Admin reset passwords and what we're seeing are simply the new MD5 hashed values
ganymedeOption: D
D. Password compromise
volc7Option: D
All values are diff. Probably a passed compromise triggered a reset for everyone
Hs1208Option: C
C. Pass the Hash as the recorded values are in hash representation rather than clear text.
subaie503Option: D
only answer that makes sense
DapsieOption: D
The password change action and storing the password hashes are protecting against password compromise
Lipton376Option: C
C. Pass the hash
CaballerOption: C
The values provided in the scenario look like hashed representations of passwords. When a security administrator resets local passwords and stores them in a hashed format, it is likely done to protect against pass-the-hash attacks.
francuzaOption: C
its is local users hashes not passed anywhere