Which Windows security feature creates a protected, isolated region of memory to prevent credential theft tools like Mimikatz from extracting NTLM hashes and Kerberos tickets from LSASS?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — Credential Guard using Virtualization-Based Security is correct because it puts LSASS secrets in a hypervisor-protected region, so you can stop Mimikatz-style extraction of NTLM hashes and Kerberos tickets. BitLocker only encrypts disk volumes at rest, so it won't protect in-memory credentials.
Full Explanation
Credential Guard using Virtualization-Based Security is correct because it uses VBS to isolate LSASS secrets in a hypervisor-protected region (VSM), preventing even administrators or kernel-level code from extracting credentials stored in LSASS. BitLocker Drive Encryption is wrong because it encrypts disk volumes at rest but does not protect in-memory credentials. Windows Hello for Business is wrong because it provides strong authentication but does not protect LSASS memory from credential theft tools. The Protected Users security group is wrong because it applies additional authentication restrictions but does not isolate LSASS memory from extraction.