Which type of credential content is identified in HKLM\SECURITY\Policy\Secrets as being stored in plain text?

• A. Service account passwords in plain text
• B. IAS account names and passwords
• C. Local store PKI Kerberos certificates
• D. Cached password hashes for the past 20 users

Answer: (A)

The key location HKLM\SECURITY\Policy\Secrets holds Local Security Authority (LSA) secrets that include credential data used by Windows services. In this area, service account passwords have historically been stored in plaintext so that services running under those accounts could authenticate after a reboot or restart. This makes the content at that path directly recoverable as plain text, which is why service account passwords in plain text is the correct description of what’s identified there.

Other types of credentials wouldn’t be described as plain text in this Secrets location. IAS account names and passwords aren’t the typical contents of this registry path, certificates used for PKI Kerberos live in certificate stores rather than in LSA Secrets, and cached password hashes for users reside in SAM/LSA caches rather than as plaintext data in this Secrets key.