Active Directory/Domains GDAT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of a service ticket in Kerberos authentication?

   • AIt provides a list of all domain controllers to the client.
   • BIt is used to renew the TGT before it expires.
   • CIt allows the client to authenticate to a specific service without re-entering credentials.
   • DIt encrypts the user's password for transmission to the domain controller.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In an Active Directory domain, which component is responsible for authenticating users and issuing security tokens for access to domain resources?

   • ADNS server
   • BGlobal catalog server
   • CDomain controller
   • DOrganizational unit
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a common misconfiguration that can lead to domain privilege escalation?

   • AUsers having the 'Change Password' permission on their own account
   • BUsers having the 'Read' permission on their own user object
   • CUsers having the 'Logon Locally' right on a domain controller
   • DUsers having the 'Replicating Directory Changes' permission
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester has gained write access to a GPO that applies to the 'Workstations' OU. The tester wants to achieve persistent administrative access to all workstations in that OU. Which action is most effective?

   • ALink the GPO to the Domain Controllers OU to ensure the tester's account is added to the local Administrators group on DCs.
   • BAdd a scheduled task to the GPO that runs a script to create a local admin account on each workstation.
   • CUse the GPO to deploy a certificate that allows the tester to authenticate as any user.
   • DModify the GPO's security settings to add the tester's account to the 'Domain Admins' group.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are assessing a multi-forest environment. Forest A has a one-way trust where Forest A trusts Forest B. You have compromised a domain admin in Forest B. Which statement is most accurate regarding your ability to access resources in Forest A?

   • AYou automatically have full administrative access to all resources in Forest A because Forest A trusts Forest B.
   • BYou can authenticate to Forest A resources, but your access is limited to the permissions granted to the Forest B users or groups.
   • CYou cannot access any resources in Forest A because the trust is one-way.
   • DYou can access Forest A only if you also compromise a domain admin in Forest A.
   Reveal Solution Discussion Select an answer first