You have captured a TGS for a service account that accesses a database. You want to access the database as that service account. What is the most direct technique?

Inject the TGS into your session and connect to the database

Use the TGS to perform a pass-the-hash attack

Use the TGS to crack the service account's password

Use the TGS to impersonate a token on the database server

You have gained local administrator access on a Windows server that runs a service with a high-privilege access token. You need to escalate privileges to access files that only the service account can read. Which technique should you use?

Use token impersonation to adopt the service account's token and access the files.

Use Pass-the-Ticket with a TGT for the service account.

Use Pass-the-Hash with the service account's NTLM hash.

Crack the service account's password from the token.

During an internal penetration test, you capture a hash from a Windows domain-joined host that starts with `$NT$` and is 32 hexadecimal characters long. You need to crack it offline. Which tool and mode should you use?

Hashcat mode 1000 with the captured hash

John the Ripper with the `--format=nt2` option

Hashcat mode 5600 with the captured hash

Hashcat mode 3000 with the captured hash

GIAC Penetration Tester (GPEN)

Domain 3Objective 3

Attacking Password Hashes GPEN Practice Questions (Page 3)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 11–15

11application · medium
You have captured a TGS for a service account that accesses a database. You want to access the database as that service account. What is the most direct technique?
Select an answer first
12application · medium
You have gained local administrator access on a Windows server that runs a service with a high-privilege access token. You need to escalate privileges to access files that only the service account can read. Which technique should you use?
Select an answer first
13foundation · easy
Which factor is most important to monitor during an online brute-force attack to avoid locking out accounts?
Select an answer first
14foundation · easy
Which Hashcat mode is specifically designed for cracking NTLM hashes?
Select an answer first
15application · medium
During an internal penetration test, you capture a hash from a Windows domain-joined host that starts with `$NT$` and is 32 hexadecimal characters long. You need to crack it offline. Which tool and mode should you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Attacking Password Hashes GPEN Practice Questions (Page 3)

Questions 11–15

You have captured a TGS for a service account that accesses a database. You want to access the database as that service account. What is the most direct technique?

You have gained local administrator access on a Windows server that runs a service with a high-privilege access token. You need to escalate privileges to access files that only the service account can read. Which technique should you use?

Which factor is most important to monitor during an online brute-force attack to avoid locking out accounts?

Which Hashcat mode is specifically designed for cracking NTLM hashes?

During an internal penetration test, you capture a hash from a Windows domain-joined host that starts with `$NT$` and is 32 hexadecimal characters long. You need to crack it offline. Which tool and mode should you use?

Keep studying — Password Attacks and Credential Attacks