During a penetration test, a tester uses the tool BloodHound to map an Active Directory environment. What specific risk does BloodHound expose that is difficult to identify manually?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — BloodHound maps Active Directory relationships like group memberships, ACLs, local admin rights, and session data, then finds multi-hop paths to Domain Admin that are hard to spot manually. You can't rely on it for patch status, open ports, or weak passwords.
Full Explanation
The correct answer is the attack paths to Domain Admin privileges through chains of group memberships, ACL permissions, and session information that are difficult to see without graphical analysis. BloodHound graphs relationships in Active Directory, including group memberships, ACLs, local admin rights, and session data, and uses path-finding algorithms to reveal multi-hop privilege escalation paths to Domain Admin that would require extensive manual analysis to discover. The outdated OS versions and missing patches option is wrong because patch status is identified with vulnerability scanners or WSUS reports, not BloodHound's AD relationship analysis. The open network ports and services option is wrong because open ports and services are discovered with port scanners like Nmap, not BloodHound. The weak passwords option is wrong because weak passwords are identified with password cracking tools such as Hashcat or John the Ripper against captured hashes, not BloodHound.