Mitigating Pass-the-Hash Vulnerability

B.

Pass-the-hash is a type of attack where an attacker captures the hashed credentials of a user and then uses them to authenticate to a system without knowing the actual password. To mitigate this vulnerability in a Windows infrastructure, the security analyst should take the following steps:

Option B: Disable NTLM NTLM is an old and vulnerable authentication protocol that is susceptible to pass-the-hash attacks. Disabling NTLM and using more secure protocols like Kerberos can help minimize the risk of pass-the-hash attacks.

Option C: Enable Kerberos Kerberos is a strong authentication protocol that uses a ticket-based system to authenticate users and services. Enabling Kerberos and disabling other weak protocols like NTLM can help mitigate the risk of pass-the-hash attacks.

Option A: Enable CHAP CHAP (Challenge-Handshake Authentication Protocol) is an authentication protocol that is commonly used in remote access scenarios. While CHAP is secure, it is not a suitable solution to mitigate pass-the-hash attacks on a Windows infrastructure.

Option D: Disable PAP PAP (Password Authentication Protocol) is a plaintext authentication protocol that is used in some remote access scenarios. While disabling PAP can help increase security, it is not a suitable solution to mitigate pass-the-hash attacks on a Windows infrastructure.

In summary, to minimize the risk of pass-the-hash attacks on a Windows infrastructure, the security analyst should disable weak protocols like NTLM and enable stronger authentication protocols like Kerberos. Option B (Disable NTLM) and Option C (Enable Kerberos) are the best choices to achieve this.