Active Directory Penetration Testing CPENT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   You are enumerating Active Directory using LDAP queries. Which LDAP query would you use to find all user objects that are members of the 'Domain Admins' group?

   • A(&(objectClass=user)(sAMAccountName=*))
   • B(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com)
   • C(&(objectClass=user)(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com))
   • D(objectClass=group)
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   You have compromised a domain user and need to execute a command on a remote Windows server without creating a new service or writing a binary to disk. You want to minimize the chance of detection by EDR. Which technique is most appropriate?

   • AUse RDP to log in and run commands interactively.
   • BUse WMI via wmic or PowerShell Invoke-WmiMethod to run a process on the remote server.
   • CUse PsExec to copy a binary to the remote server and create a service.
   • DUse SMB to copy a payload to the remote server's admin share and execute it.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are on a penetration test with a strict rule: do not modify any AD objects (no adding users, no changing group memberships, no ACL changes). You have low-privileged credentials and have found that a service account 'svc_app' has a weak password and is a member of 'Backup Operators'. You need to escalate to domain admin. Which approach is most aligned with the constraint?

   • AAdd your user to the 'Backup Operators' group using an ACL misconfiguration found with BloodHound.
   • BPerform a Kerberoasting attack on the service account and then use the cracked password to modify the adminSDHolder ACL.
   • CUse the service account's credentials to create a scheduled task on a domain controller that runs a script to add your user to Domain Admins.
   • DCrack the service account's password, then use Backup Operators privileges to copy the NTDS.dit and SYSTEM hive from a domain controller, extract hashes, and use a DCSync-like attack offline.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which Windows remote management protocol uses TCP port 5985 (or 5986 for HTTPS) and allows PowerShell remoting, making it a common lateral movement technique?

   • AWMI
   • BWinRM
   • CRDP
   • DSMB
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are testing a multi-domain forest. You have compromised a domain admin in Domain A. Domain B has a bidirectional trust with Domain A. Which technique would allow you to compromise Domain B?

   • APerform a DCSync attack on Domain B's domain controller.
   • BUse the trust relationship to request a TGT for Domain B using the inter-realm trust key.
   • CRun Kerberoasting against Domain B's service accounts.
   • DUse a golden ticket for Domain A and then use it to access Domain B directly.
   Reveal Solution Discussion Select an answer first