During a penetration test, a tester uses the tool BloodHound to map an Active Directory environment. What specific risk does BloodHound expose that is difficult to identify manually?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because BloodHound graphs relationships in Active Directory (group memberships, ACLs, local admin rights, session data) and uses path-finding algorithms to reveal multi-hop privilege escalation paths to Domain Admin that would require extensive manual analysis to discover. A is wrong because patch status is identified with vulnerability scanners or WSUS reports, not BloodHound's AD relationship analysis.
Full explanation below image
Full Explanation
B is correct because BloodHound graphs relationships in Active Directory (group memberships, ACLs, local admin rights, session data) and uses path-finding algorithms to reveal multi-hop privilege escalation paths to Domain Admin that would require extensive manual analysis to discover. A is wrong because patch status is identified with vulnerability scanners or WSUS reports, not BloodHound's AD relationship analysis. C is wrong because open ports and services are discovered with port scanners like Nmap, not BloodHound. D is wrong because weak passwords are identified with password cracking tools (Hashcat, John the Ripper) against captured hashes, not BloodHound.