NTLM Authentication Fundamentals Quiz

1.NTLM never sends the user's password across the network. Why is this not the same as being secure against credential theft?

• Because the password hash is stored in plaintext on the server
• Because the response transmitted on the wire is mathematically derived from the password hash and can be captured for offline cracking or relayed live to another service
• Because NTLM transmits the username and the server can look up the password
• Because NTLM signs all messages by default, which exposes the signing key

2.What is the purpose of the server challenge (nonce) in the NTLM three-message exchange?

• To encrypt the user's password before it is sent to the domain controller
• To make each authentication response unique so that a captured response cannot be replayed in a later session
• To identify which domain controller should process the authentication request
• To encrypt the AUTHENTICATE message in transit

3.Why does a member server forward the NTLM response to a domain controller instead of verifying it locally?

• Because member servers are not allowed to process authentication requests under any circumstances
• Because verifying the response requires the user's password hash, which member servers do not hold; only domain controllers store domain account hashes in NTDS.dit
• Because member servers lack the processing power to run the NTLM algorithm
• Because NTLM requires a third-party arbitration service for all enterprise authentication

4.An attacker captures an NTLMv2 challenge-response during an assessment. What two distinct paths does this open?

• Replaying the captured response immediately and using it to read the DC's NTDS.dit
• Offline cracking to recover the underlying password, or relaying the live response to another service to authenticate as the victim without cracking
• Decrypting the response to extract the plaintext password, or injecting a new response into the session
• Using the response to forge a Kerberos ticket, or resetting the victim's password directly

5.Why does requiring SMB signing stop relay attacks but not offline cracking attempts?

• Because SMB signing encrypts the challenge so it cannot be captured at all
• Because signing binds the session to the negotiated keys: a relayed response arrives without the victim's session keys, so the signature check fails, but offline cracking only needs the captured response, not a live session
• Because SMB signing forces the use of Kerberos, which cannot be captured
• Because SMB signing shortens the validity window of the challenge so there is not enough time to relay it

6.What is the most accurate way to explain why NTLM relay is so common in Active Directory assessments?

• Because AD always prefers NTLM over Kerberos for internal connections
• Because NTLM remains available as a fallback in nearly all environments, many connections still use it, and SMB signing is often not enforced on member servers, so relay conditions are easy to reach
• Because attackers can disable Kerberos on demand, forcing all clients to fall back to NTLM
• Because NTLM relay requires no initial foothold and works from the internet

7.Which statement best captures the difference between NTLMv1 and NTLMv2?

• NTLMv1 uses the password directly; NTLMv2 hashes it before use
• NTLMv2 incorporates a client-side nonce and uses a stronger HMAC-MD5 computation, making the response harder to crack offline than NTLMv1's simpler DES-based computation, and NTLMv1 is deprecated because it is weak enough to crack quickly even without a GPU
• NTLMv1 and NTLMv2 are identical in strength; the version number is a marketing label
• NTLMv2 sends the password hash in the AUTHENTICATE message while NTLMv1 does not