Which Windows security feature creates a protected, isolated region of memory to prevent credential theft tools like Mimikatz from extracting NTLM hashes and Kerberos tickets from LSASS?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Credential Guard uses VBS to isolate LSASS secrets in a hypervisor-protected region (VSM), preventing even administrators or kernel-level code from extracting credentials stored in LSASS. A is wrong because BitLocker encrypts disk volumes at rest but does not protect in-memory credentials.
Full explanation below image
Full Explanation
B is correct because Credential Guard uses VBS to isolate LSASS secrets in a hypervisor-protected region (VSM), preventing even administrators or kernel-level code from extracting credentials stored in LSASS. A is wrong because BitLocker encrypts disk volumes at rest but does not protect in-memory credentials. C is wrong because Windows Hello provides strong authentication but does not protect LSASS memory from credential theft tools. D is wrong because the Protected Users group applies additional authentication restrictions but does not isolate LSASS memory from extraction.