Active Directory Penetration Testing CPENT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You have achieved domain admin privileges during a penetration test. The client wants to ensure that even if the current domain admin password is changed, you can still regain domain admin access later. Which persistence mechanism is most resilient to password changes?

   • AAdd a new user to the Domain Admins group with a known password.
   • BModify the adminSDHolder ACL to grant your user full control.
   • CInstall a skeleton key on the domain controller.
   • DCreate a golden ticket using the KRBTGT account hash.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an internal penetration test, you have domain user credentials and are asked to identify the fastest path to Domain Admin without running any tools that write to disk. You have network access to the domain controller and can execute PowerShell in memory. Which approach best meets the objective?

   • AUse LDAP queries via adfind.exe to enumerate all users and groups, then manually review group memberships for privileged accounts.
   • BRun a Kerberoasting attack immediately to obtain service account hashes, then crack them offline to gain Domain Admin.
   • CUse the built-in net group command to list domain admins and then attempt password spraying against those accounts.
   • DRun BloodHound from a memory-loaded PowerShell script to map ACL-based attack paths, then use PowerView to enumerate group memberships and ACLs.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What does a DCSync attack allow an attacker to do?

   • ACreate a new domain controller in the domain
   • BMimic a domain controller and request replication of password hashes from the directory
   • CForce a password change for all users
   • DSynchronize the time across the domain
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary difference between a domain trust and a forest trust in Active Directory?

   • AA domain trust connects two domains within the same forest, while a forest trust connects two separate forests.
   • BA domain trust is always bidirectional, while a forest trust is always one-way.
   • CA domain trust requires a shared DNS namespace, while a forest trust does not.
   • DA domain trust is used for authentication, while a forest trust is used for authorization only.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You have discovered a user account 'svc_web' that has 'Do not require Kerberos pre-authentication' enabled. You have low-privileged credentials. What is the most efficient way to obtain a password hash for this account?

   • APerform Kerberoasting by requesting a service ticket for the account's SPN.
   • BUse DCSync to replicate the domain and extract the hash.
   • CPerform an AS-REP roast by sending an AS-REQ without pre-authentication and cracking the response.
   • DUse a pass-the-hash attack with the current user's hash.
   Reveal Solution Discussion Select an answer first