An organization wants to prevent lateral movement via Pass-the-Hash attacks on Windows. Which control most directly mitigates this attack at the endpoint level?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Protected Users prevents credential caching and forces Kerberos (eliminating NTLM hash reuse), while LAPS ensures each machine has a unique local admin password — meaning a stolen local admin hash from one machine cannot be used to authenticate to other machines. A is wrong because password complexity does not prevent pass-the-hash; the attack reuses the hash directly without needing to crack the password.
Full explanation below image
Full Explanation
B is correct because Protected Users prevents credential caching and forces Kerberos (eliminating NTLM hash reuse), while LAPS ensures each machine has a unique local admin password — meaning a stolen local admin hash from one machine cannot be used to authenticate to other machines. A is wrong because password complexity does not prevent pass-the-hash; the attack reuses the hash directly without needing to crack the password. C is wrong because antivirus may detect Mimikatz tools used to extract hashes but cannot prevent hash reuse if the hash is already captured. D is wrong because MFA for web applications does not protect NTLM authentication on the internal Windows network where PtH occurs.