What is the purpose of modifying the AdminSDHolder object's ACL for persistence?

To create a new domain controller

To disable Kerberos pre-authentication for all users

To grant a specific user or group full control over all protected groups

What is the primary goal of domain escalation attacks in an Active Directory environment?

To exfiltrate data from a single workstation

To disable security logging across the domain

To move from a standard user to a domain administrator

To map the network topology of the domain

A penetration tester has domain admin privileges and wants to maintain persistence by executing a malicious script on all workstations in the domain. The tester wants the script to run at startup on every workstation. Which technique should the tester use?

Modify the AdminSDHolder ACL to grant DCSync rights

Create a Group Policy Object (GPO) that runs a startup script

Perform a DCSync attack to extract hashes

Forge a golden ticket to access all workstations

What is the main advantage of a Silver Ticket attack over a Golden Ticket attack?

It does not require any password hashes

It provides access to all services in the domain

It is valid for a longer period than a Golden Ticket

It is harder to detect because it does not require contact with the domain controller

A penetration tester is assessing a forest with multiple domains. The tester has compromised a domain admin in Domain A and wants to gain access to Domain B. The trust relationship is a two-way transitive trust. The tester has the KRBTGT hash of Domain A. What is the most effective way to compromise Domain B?

Inject a SID History of Domain B's Enterprise Admins group into a Domain A account

Forge a golden ticket for Domain A and use the trust to access Domain B

Use the skeleton key attack on Domain B's domain controller

Perform a DCSync attack on Domain B using the KRBTGT hash of Domain A

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 1)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 1–5

1foundation · easy
What is the purpose of modifying the AdminSDHolder object's ACL for persistence?
Select an answer first
2foundation · easy
What is the primary goal of domain escalation attacks in an Active Directory environment?
Select an answer first
3application · medium
A penetration tester has domain admin privileges and wants to maintain persistence by executing a malicious script on all workstations in the domain. The tester wants the script to run at startup on every workstation. Which technique should the tester use?
Select an answer first
4foundation · easy
What is the main advantage of a Silver Ticket attack over a Golden Ticket attack?
Select an answer first
5expert · hard
A penetration tester is assessing a forest with multiple domains. The tester has compromised a domain admin in Domain A and wants to gain access to Domain B. The trust relationship is a two-way transitive trust. The tester has the KRBTGT hash of Domain A. What is the most effective way to compromise Domain B?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.