Why is it important to identify the hash algorithm before attempting to crack it?

To determine the correct cracking mode and expected speed

To know the user's password policy

You have compromised a workstation and obtained an NTLM hash for a domain user. The domain is configured to use Kerberos, and SMB signing is required on all servers. You need to access a file share on a server. Which technique is most likely to succeed?

Use pass-the-hash with SMB, but SMB signing is required, so it may fail

Use a golden ticket to forge a TGT

Use pass-the-ticket with a Kerberos ticket extracted from memory

Use a silver ticket to forge a service ticket

You have compromised a workstation in a domain and extracted a Kerberos TGT from memory. You want to use this ticket to access a file server as the same user. What is the most direct way to use this ticket?

Use the ticket to crack the user's password offline

Use the ticket with mimikatz's kerberos::ptt command to inject it into your current session

Use the ticket to perform a Kerberoasting attack

Use the ticket to perform an AS-REP roast

You are assessing a legacy application that uses unsalted MD5 hashes. You have a rainbow table set that covers the 8-character lowercase alphanumeric keyspace. The application also accepts 9-character passwords. You have limited storage and need to crack as many hashes as possible. Which approach is most effective?

Use only the rainbow tables because they are fast

Use a hybrid attack with the rainbow table wordlist

Use a brute-force attack for all passwords up to 9 characters

Use the rainbow tables for 8-character passwords and a dictionary attack for 9-character passwords

During an internal penetration test, you obtain an NTLM hash for a domain user from a compromised workstation. You need to access a file share on a server that does not require SMB signing. Which technique would allow you to authenticate to the file share without knowing the plaintext password?

Pass-the-hash using the NTLM hash

Pass-the-ticket using a Kerberos ticket

Crack the hash offline and use the plaintext password

Use a golden ticket to forge a TGT

GIAC Penetration Tester (GPEN)

Domain 3Objective 4

Advanced Password Attacks GPEN Practice Questions (Page 1)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

15concepts

Questions 1–5

1foundation · easy
Why is it important to identify the hash algorithm before attempting to crack it?
Select an answer first
2expert · hard
You have compromised a workstation and obtained an NTLM hash for a domain user. The domain is configured to use Kerberos, and SMB signing is required on all servers. You need to access a file share on a server. Which technique is most likely to succeed?
Select an answer first
3application · medium
You have compromised a workstation in a domain and extracted a Kerberos TGT from memory. You want to use this ticket to access a file server as the same user. What is the most direct way to use this ticket?
Select an answer first
4expert · hard
You are assessing a legacy application that uses unsalted MD5 hashes. You have a rainbow table set that covers the 8-character lowercase alphanumeric keyspace. The application also accepts 9-character passwords. You have limited storage and need to crack as many hashes as possible. Which approach is most effective?
Select an answer first
5application · medium
During an internal penetration test, you obtain an NTLM hash for a domain user from a compromised workstation. You need to access a file share on a server that does not require SMB signing. Which technique would allow you to authenticate to the file share without knowing the plaintext password?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.