During an assessment, you find that a domain user 'jsmith' has 'GenericAll' permission on the group 'IT_Admins'. The group 'IT_Admins' is a member of 'Domain Admins'. What is the most direct way to escalate to domain admin privileges?

Modify the ACL on the Domain Admins group to grant 'jsmith' full control.

Use DCSync to replicate the domain and extract the KRBTGT hash.

Perform a Kerberoasting attack against the IT_Admins group's SPN.

Add 'jsmith' to the 'IT_Admins' group using the ACL permission, then use the new group membership to access domain admin resources.

You have compromised a server with unconstrained delegation. You need to escalate to Domain Admin, but the domain admin rarely authenticates to this server. You have the ability to coerce authentication from a domain admin using a known vulnerability. Which technique best combines coercion and delegation to achieve DA?

Use the Printer Bug or PetitPotam to coerce the domain admin's machine to authenticate to the compromised server, then capture the TGT with Rubeus.

Modify the adminSDHolder object to grant yourself rights.

Use DCSync to replicate the krbtgt hash from the domain controller.

Use Kerberoasting to obtain a service ticket for the domain admin account.

What is the primary purpose of the adminSDHolder object in Active Directory?

To manage DNS records for the domain

To store backup copies of all user passwords

To log all administrative actions

To protect privileged accounts and groups from unauthorized ACL changes by reapplying their permissions every 60 minutes

You are performing lateral movement and want to avoid triggering Windows Defender or other EDR on the target. Which approach is most likely to evade detection?

Use PowerShell to download and execute a Meterpreter payload in memory.

Copy a custom executable to the target's admin share and execute it via WMI.

Use a living-off-the-land binary like schtasks to create a scheduled task that runs a built-in command.

Use PsExec to run a command on the target.

EC-CouncilCertified Penetration Testing Professional

Domain 5Objective 1

Active Directory Penetration Testing CPENT Practice Questions (Page 7)

Part of the Active Directory and Lateral Movement domain, which makes up ~8% of our current practice bank.

34questions here

7free pages

8concepts

Questions 31–34

31application · medium
During an assessment, you find that a domain user 'jsmith' has 'GenericAll' permission on the group 'IT_Admins'. The group 'IT_Admins' is a member of 'Domain Admins'. What is the most direct way to escalate to domain admin privileges?
Select an answer first
32expert · hard
You have compromised a server with unconstrained delegation. You need to escalate to Domain Admin, but the domain admin rarely authenticates to this server. You have the ability to coerce authentication from a domain admin using a known vulnerability. Which technique best combines coercion and delegation to achieve DA?
Select an answer first
33foundation · easy
What is the primary purpose of the adminSDHolder object in Active Directory?
Select an answer first
34application · medium
You are performing lateral movement and want to avoid triggering Windows Defender or other EDR on the target. Which approach is most likely to evade detection?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Active Directory Penetration Testing CPENT Practice Questions (Page 7)

Questions 31–34

During an assessment, you find that a domain user 'jsmith' has 'GenericAll' permission on the group 'IT_Admins'. The group 'IT_Admins' is a member of 'Domain Admins'. What is the most direct way to escalate to domain admin privileges?

What is the primary purpose of the adminSDHolder object in Active Directory?

You are performing lateral movement and want to avoid triggering Windows Defender or other EDR on the target. Which approach is most likely to evade detection?

Keep studying — Active Directory and Lateral Movement