Active Directory Penetration Testing CPENT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   You have Domain Admin privileges and want to establish persistence that survives a krbtgt password reset (performed twice) and is not easily detected by security teams. Which method is most appropriate?

   • ACreate a Golden Ticket using the current krbtgt hash and use it to access the domain.
   • BInstall a skeleton key on the domain controller.
   • CCreate a Silver Ticket for a specific service using a service account hash.
   • DModify the adminSDHolder object to grant a backdoor account Domain Admin rights.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You have compromised a server that has 'Unconstrained Delegation' enabled. You are a standard domain user. Which attack would allow you to capture a domain admin's TGT and escalate privileges?

   • AModify the adminSDHolder object to grant yourself rights.
   • BPerform a Kerberoasting attack against the server's service account to obtain a TGT.
   • CUse DCSync to replicate the krbtgt hash from the domain controller.
   • DUse the Rubeus monitor command to wait for a domain admin to authenticate to the server, then extract their TGT from memory.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Active Directory misconfiguration allows a user to authenticate to a service that then impersonates the user on behalf of the service, potentially allowing the attacker to access other resources as the user?

   • AConstrained delegation
   • BSID history
   • CUnconstrained delegation
   • DKerberos pre-authentication disabled
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a 'living-off-the-land' (LOL) binary in the context of Active Directory penetration testing?

   • AA binary that is specifically designed for penetration testing
   • BA binary that has been patched by Microsoft to prevent abuse
   • CA legitimate Windows binary that can be used for malicious purposes without uploading additional tools
   • DA binary that is only available on Linux systems
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You have obtained a low-privileged domain user account and need to move laterally to a file server. You discover that a service account 'svc_backup' has a Service Principal Name (SPN) and is a local administrator on the file server. Which attack would allow you to obtain a password hash for 'svc_backup' without sending any traffic to the file server?

   • AKerberoasting: request a service ticket for the SPN and crack the encrypted portion offline.
   • BNTLM relay: coerce the file server to authenticate to you and relay the authentication to obtain a ticket.
   • CAS-REP roasting: send an AS-REQ without pre-authentication for 'svc_backup' and crack the response.
   • DPass-the-hash: use the current user's NTLM hash to authenticate to the file server and then dump the local SAM.
   Reveal Solution Discussion Select an answer first