A red teamer has compromised a domain controller and wants to establish a persistence mechanism that survives the krbtgt password reset and is not immediately detected by standard auditing. Which mechanism is most appropriate?

Modify the adminSDHolder object to grant the red teamer's account 'Full Control' on protected groups.

Install a skeleton key on the domain controller.

Create a golden ticket using the current krbtgt hash.

Create a new domain admin account and add it to the Domain Admins group.

What is a Group Policy Object (GPO) primarily used for in an Active Directory environment?

Centralized management of settings and configurations for users and computers

Managing DNS records for the domain

Creating user accounts and groups

Storing user passwords in a secure database

Which of the following is a common remote execution method used for lateral movement in Windows environments?

Windows Management Instrumentation (WMI)

Simple Network Management Protocol (SNMP)

Dynamic Host Configuration Protocol (DHCP)

A red teamer has obtained the NTLM hash of a service account that is used by a web application. The service account is a member of the 'Domain Admins' group. The teamer wants to authenticate to a domain controller without knowing the plaintext password. Which technique is most appropriate?

Use Kerberoasting to request a service ticket for the domain controller and crack it offline.

Use the hash to forge a golden ticket for the domain.

Use Pass-the-Hash with the NTLM hash to authenticate to the domain controller via SMB.

Use the hash to modify the service account's password via LDAP.

GIAC Defending Advanced Threats

Domain 2Objective 3

Active Directory/Domains GDAT Practice Questions (Page 7)

Part of the Post-Exploitation and Movement domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

Questions 31–35

31expert · hard
A red teamer has compromised a domain controller and wants to establish a persistence mechanism that survives the krbtgt password reset and is not immediately detected by standard auditing. Which mechanism is most appropriate?
Select an answer first
32foundation · easy
What is a Group Policy Object (GPO) primarily used for in an Active Directory environment?
Select an answer first
33foundation · easy
Which of the following is a common remote execution method used for lateral movement in Windows environments?
Select an answer first
34application · medium
A red teamer has obtained the NTLM hash of a service account that is used by a web application. The service account is a member of the 'Domain Admins' group. The teamer wants to authenticate to a domain controller without knowing the plaintext password. Which technique is most appropriate?
Select an answer first
35foundation · easy
Which native Windows command-line tool can be used to enumerate all users in an Active Directory domain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.