You have compromised a domain admin account and want to maintain persistence even if the domain admin password is changed. You decide to modify the adminSDHolder object. Which effect does this have?

It grants the specified account full control over all protected groups, and the permission is reapplied every 60 minutes by the SDProp process.

It disables the SIDHistory attribute for all domain admins.

It changes the KRBTGT password, invalidating all existing Kerberos tickets.

It creates a new domain admin account that is hidden from enumeration.

What is the purpose of the 'pass-the-hash' attack?

To create a new user account in the domain

To disable Kerberos authentication

To authenticate to remote systems using a captured NTLM hash without knowing the plaintext password

To crack a password hash offline

You have compromised a domain user account that has the 'Replicating Directory Changes' permission. You want to escalate to domain admin without triggering immediate detection. Which technique is most appropriate?

Use Pass-the-Hash with the current user's hash to access domain controllers.

Use DCSync to extract the KRBTGT hash and then forge a golden ticket for a fake domain admin account.

Use Kerberoasting to request service tickets for domain admin accounts.

Use the MS16-032 exploit to escalate privileges locally on the current machine.

A red teamer has compromised the krbtgt account hash of a domain. They want to maintain access to the domain for an extended period without being detected by periodic password changes of user accounts. Which persistence mechanism is most appropriate?

Create a new domain admin account and add it to the Domain Admins group.

Create a golden ticket for a user account that is not subject to periodic password changes.

Install a skeleton key on all domain controllers to allow a universal backdoor password.

Modify the adminSDHolder object to grant the red teamer's account full control over all protected groups.

During an assessment, you discover that a domain user account has the 'Replicating Directory Changes' permission on the domain. You want to escalate to domain admin. Which technique is most directly enabled by this permission?

Use the Pass-the-Hash attack with the current user's hash to access domain controllers.

Use Kerberoasting to request service tickets for domain admin accounts.

Use the MS16-032 exploit to escalate privileges locally on the current machine.

Use the DCSync attack to impersonate a domain controller and request password hashes from the domain.

GIAC Defending Advanced Threats

Domain 2Objective 3

Active Directory/Domains GDAT Practice Questions (Page 6)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

Questions 26–30

26application · medium
You have compromised a domain admin account and want to maintain persistence even if the domain admin password is changed. You decide to modify the adminSDHolder object. Which effect does this have?
Select an answer first
27foundation · easy
What is the purpose of the 'pass-the-hash' attack?
Select an answer first
28expert · hard
You have compromised a domain user account that has the 'Replicating Directory Changes' permission. You want to escalate to domain admin without triggering immediate detection. Which technique is most appropriate?
Select an answer first
29expert · hard
A red teamer has compromised the krbtgt account hash of a domain. They want to maintain access to the domain for an extended period without being detected by periodic password changes of user accounts. Which persistence mechanism is most appropriate?
Select an answer first
30application · medium
During an assessment, you discover that a domain user account has the 'Replicating Directory Changes' permission on the domain. You want to escalate to domain admin. Which technique is most directly enabled by this permission?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.