You have compromised a domain-joined Windows 10 workstation and have local administrator privileges. You want to move laterally to a file server that uses the same local administrator password as the workstation. Which technique is most efficient?

Use BloodHound to find a path to the file server and then exploit a GPO to add your domain account to the file server's local admins.

Use PsExec with your domain credentials to execute a command on the file server.

Use Mimikatz to dump the local SAM database and then use the local administrator hash to authenticate to the file server via Pass-the-Hash.

Use Kerberoasting to obtain a service ticket for the file server and crack it offline.

You have compromised a domain user account and want to access a service that is configured to use Kerberos with AES256 encryption. You have the user's NTLM hash. Which technique is most likely to succeed?

Use a golden ticket with the KRBTGT hash to forge a TGT for the user.

Use pass-the-hash directly against the service using NTLM authentication.

Use a silver ticket with the service's hash to forge a service ticket.

Use over-pass-the-hash with the NTLM hash to request a TGT, then request a service ticket for the target service.

During an engagement, you discover that a member server running an outdated application responds to NTLM authentication requests and has SMB signing disabled. You have a foothold on a workstation in the same subnet. You want to move laterally to the member server without knowing its local administrator password. Which technique is most appropriate?

Use PsExec to execute a command on the member server using the workstation's machine account.

Use Mimikatz to dump cached credentials from the workstation and then use those credentials to access the member server.

Use Responder to capture an NTLM challenge from the member server and relay it to the workstation to authenticate as the current user.

Use Responder to poison LLMNR/NBT-NS and relay the captured NTLM authentication to the member server's SMB service.

You have compromised a domain controller and dumped the KRBTGT hash. You want to maintain access to the domain even if the current domain admin password is changed. Which technique is most appropriate?

Forge a golden ticket for a fake user with domain admin privileges using the KRBTGT hash.

Create a new domain admin account using the current domain admin credentials.

Modify the adminSDHolder object to grant yourself full control over all protected groups.

Use the DCSync attack to extract the hash of the new domain admin after the password change.

GIAC Defending Advanced Threats

Domain 2Objective 3

Active Directory/Domains GDAT Practice Questions (Page 3)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

Questions 11–15

11application · medium
You have compromised a domain-joined Windows 10 workstation and have local administrator privileges. You want to move laterally to a file server that uses the same local administrator password as the workstation. Which technique is most efficient?
Select an answer first
12foundation · easy
Which tool is commonly used to extract credentials from memory on a Windows system?
Select an answer first
13expert · hard
You have compromised a domain user account and want to access a service that is configured to use Kerberos with AES256 encryption. You have the user's NTLM hash. Which technique is most likely to succeed?
Select an answer first
14application · medium
During an engagement, you discover that a member server running an outdated application responds to NTLM authentication requests and has SMB signing disabled. You have a foothold on a workstation in the same subnet. You want to move laterally to the member server without knowing its local administrator password. Which technique is most appropriate?
Select an answer first
15application · medium
You have compromised a domain controller and dumped the KRBTGT hash. You want to maintain access to the domain even if the current domain admin password is changed. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Active Directory/Domains GDAT Practice Questions (Page 3)

Questions 11–15

You have compromised a domain-joined Windows 10 workstation and have local administrator privileges. You want to move laterally to a file server that uses the same local administrator password as the workstation. Which technique is most efficient?

Which tool is commonly used to extract credentials from memory on a Windows system?

You have compromised a domain user account and want to access a service that is configured to use Kerberos with AES256 encryption. You have the user's NTLM hash. Which technique is most likely to succeed?

You have compromised a domain controller and dumped the KRBTGT hash. You want to maintain access to the domain even if the current domain admin password is changed. Which technique is most appropriate?

Keep studying — Post-Exploitation and Movement