CompTIA PenTest+ (PT0-002) — Question 454

A red team gained access to the internal network of a client during an engagement and used the Responder tool to capture important data.
Which of the following was captured by the testing team?

Answer options

• A. Multiple handshakes
• B. IP addresses
• C. Encrypted file transfers
• D. User hashes sent over SMB

Correct answer: D

Explanation

The Responder tool is designed to capture authentication credentials, specifically user hashes sent over SMB, which is why option D is correct. Options A, B, and C do not accurately represent the primary function of Responder, as it focuses on capturing hashes rather than handshakes, IP addresses, or encrypted file transfers.