Skip to content
AI Security

Interview question · Systems, OS & Memory Safety

How do attackers steal and reuse credentials in a Windows enterprise, and how do you reduce the damage when an endpoint is compromised?

You cannot stop every laptop being compromised. You can decide what that laptop holds. The strong answer is about which credentials live where, and making stolen ones useless elsewhere.

hardNewPreparation tags: Microsoft, CrowdStrike, Palo Alto NetworksUpdated Nov 2026

You cannot stop every laptop being compromised. You can decide what that laptop holds. The strong answer is about which credentials live where, and making stolen ones useless elsewhere.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

An attacker gains local admin on a Windows workstation that a helpdesk engineer regularly logs on to with a privileged account.

  1. What credentials can the attacker harvest?
  2. How are they reused?
  3. Why is the helpdesk logon the real problem?
  4. Which Windows features reduce theft?
  5. What about the local administrator account?
  6. How would you reduce credential theft risk?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackWhat are the main classes of memory-safety bugs in C and C++, and why can one turn into code execution?Next in this trackWhat do ASLR, DEP/NX, stack canaries, PIE and RELRO each prevent, and what does an attacker need to get past each one?Next in this trackWhat is return-oriented programming, why did it make DEP insufficient, and how do control-flow integrity and shadow stacks respond?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.