An application owner reports suspicious activity on an internal financial application from various internal users within the past 14 days. A security analyst notices the following:
· Financial transactions were occurring during irregular time frames and outside of business hours by unauthorized users. · Internal users in question were changing their passwords frequently during that time period. · A jump box that several domain administrator users use to connect to remote devices was recently compromised.
· The authentication method used in the environment is NTLM.
Which of the following types of attacks is most likely being used to gain unauthorized access?

A. Pass-the-hash

B. Brute-force

C. Directory traversal

D. Replay





 

Correct Answer: A

This question is in SY0-601 exam
For getting CompTIA Security+ certificate