Active Directory Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   You have local admin on a server and need to move laterally to another server. The target server has Windows Defender Firewall enabled and blocks SMB (port 445) from your current server, but allows WinRM (port 5985). You have credentials for a local admin on the target. Which technique is most appropriate?

   • AUse PsExec to execute a command on the target server via SMB.
   • BUse SMB to copy a payload and execute it via a scheduled task.
   • CUse WMI to execute a process on the target server.
   • DUse WinRM to execute a PowerShell script on the target server.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   You are testing a forest with a one-way trust: Domain A trusts Domain B. You have compromised Domain A's domain admin. You want to compromise Domain B. Which technique is most likely to succeed?

   • AUse the trust key from Domain A to forge a TGT for Domain B, then use it to access Domain B resources.
   • BRun Kerberoasting against Domain B's service accounts.
   • CUse a golden ticket for Domain A to access Domain B directly.
   • DPerform a DCSync attack on Domain B's domain controller.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You have captured an NTLMv2 hash of a domain admin from a compromised workstation. The target server has SMB signing disabled. You want to move laterally to that server without cracking the hash. Which technique is most appropriate?

   • AKerberoast the target server's SPN to obtain a reusable ticket.
   • BPass-the-hash: use the NTLM hash to authenticate to the target server via SMB.
   • CUse a golden ticket to forge a TGT for the domain admin and access the server.
   • DPerform an AS-REP roast against the domain admin account to get a hash.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   You are on an internal penetration test. You have domain user credentials and need to find a path to Domain Admin. The client has a strict policy: no tools that write to disk, and you must minimize the number of LDAP queries to avoid detection. Which approach best balances stealth and effectiveness?

   • APerform a Kerberoasting attack to obtain service account hashes and crack them offline.
   • BRun BloodHound in memory with a custom LDAP filter to collect only high-value objects and ACLs, then analyze the graph offline.
   • CUse the built-in net group command to list domain admins and then attempt password spraying.
   • DUse PowerView to enumerate all users, groups, and ACLs in one go, then manually analyze the output.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary goal of an NTLM relay attack?

   • ATo forward an NTLM authentication attempt from one system to another to authenticate as the victim
   • BTo obtain a Kerberos TGT
   • CTo disable NTLM authentication on the target
   • DTo crack the NTLM hash offline
   Reveal Solution Discussion Select an answer first