A county engagement obtains an NTLM-class hash within scope. Conceptually, which distinction should guide next steps?
Select an answer to reveal the explanation.
Short Explanation
A hash is like a stamped metal key blank: you can try to reverse-engineer the shape offline, or—in some protocols—present the stamp itself. Those are different plays with different rules. Know which class you’re in before you move.
Full Explanation
When a county engagement obtains an NTLM-class hash in scope, the guiding distinction is conceptual: offline cracking recovers candidate plaintext from the hash material, whereas pass-the-hash style reuse presents the hash in authentication flows without recovering plaintext. Claiming NTLM hashes can only be used after conversion to cleartext erases a core Windows authentication reality and will mis-plan follow-on work. Treating offline cracking and hash-based authentication reuse as the same technique under different names collapses two different risk stories—credential recovery versus credential material reuse. Publishing any captured hash in the report before further testing continues is a handling mistake: secrets need controlled evidence practices, not premature broadcast. Exam caveat: questions test whether you separate “crack offline” from “reuse hash online,” not whether you memorize a specific tool flag. Operational check: record how the hash was obtained under RoE, decide whether the next authorized step is offline analysis, controlled reuse, or evidence-only, and protect the material in a vaulted appendix rather than chat or the executive summary. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.