GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ557

Endpoint Attack and Pivoting

Which action is being carried out in the following session?

Question Image

  • A Gathering Active Directory hashes
  • B Escalating privileges
  • C Creating a rescue boot disc
  • D Dumping information from the LSASS.EXE process
Explanation

ntdsutil ifm create full <path> creates full Active Directory Domain Services installation media for a writable domain controller. This installation media can support domain-controller deployment or recovery; it does not dump LSASS memory or directly gather hashes.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!