You have compromised a domain in a forest and want to cross a forest trust to compromise another domain. The trust is a forest trust with bidirectional trust. Which attack is most likely to succeed?

Relay NTLM authentication from the current domain to the target domain's SMB service.

Use DCSync on the target domain controller to replicate the krbtgt hash.

Perform a Kerberoasting attack against service accounts in the target domain.

Use the krbtgt hash of the current domain to forge a TGT with the SID of the Enterprise Admins group and request a referral ticket to the target domain.

You have discovered that a domain controller has 'Unconstrained Delegation' enabled for a computer account. You are able to compromise that computer. What is the most effective way to escalate to domain admin?

Perform Kerberoasting against the computer account's SPN.

Modify the computer account's ACL to grant it GenericAll on the domain.

Use the computer account's hash to perform a DCSync attack.

Wait for a domain admin to authenticate to the compromised computer, capture their TGT, and use it to access the domain controller.

In a pass-the-hash attack, what does the attacker use to authenticate to remote systems without knowing the plaintext password?

The NTLM hash of the user's password

EC-CouncilCertified Penetration Testing Professional

Domain 5Objective 1

Active Directory Penetration Testing CPENT Practice Questions (Page 4)

Part of the Active Directory and Lateral Movement domain, which makes up ~8% of our current practice bank.

34questions here

7free pages

8concepts

Questions 16–20

16application · medium
You have compromised a domain in a forest and want to cross a forest trust to compromise another domain. The trust is a forest trust with bidirectional trust. Which attack is most likely to succeed?
Select an answer first
17foundation · easy
Which Windows event log contains records of successful and failed logon attempts, which an attacker might clear to cover their tracks?
Select an answer first
18application · medium
You have discovered that a domain controller has 'Unconstrained Delegation' enabled for a computer account. You are able to compromise that computer. What is the most effective way to escalate to domain admin?
Select an answer first
19foundation · easy
During an Active Directory penetration test, you need to identify all domain admins, the groups they belong to, and the paths that could be used to compromise them. Which tool is specifically designed to map and visualize these attack paths using graph theory?
Select an answer first
20foundation · easy
In a pass-the-hash attack, what does the attacker use to authenticate to remote systems without knowing the plaintext password?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Active Directory Penetration Testing CPENT Practice Questions (Page 4)

Questions 16–20

You have compromised a domain in a forest and want to cross a forest trust to compromise another domain. The trust is a forest trust with bidirectional trust. Which attack is most likely to succeed?

Which Windows event log contains records of successful and failed logon attempts, which an attacker might clear to cover their tracks?

You have discovered that a domain controller has 'Unconstrained Delegation' enabled for a computer account. You are able to compromise that computer. What is the most effective way to escalate to domain admin?

During an Active Directory penetration test, you need to identify all domain admins, the groups they belong to, and the paths that could be used to compromise them. Which tool is specifically designed to map and visualize these attack paths using graph theory?

In a pass-the-hash attack, what does the attacker use to authenticate to remote systems without knowing the plaintext password?

Keep studying — Active Directory and Lateral Movement