A tester has compromised the hash of a service account that runs the SQL Server service. The tester wants to access the SQL Server database without interacting with the domain controller. Which technique is most appropriate?

Perform a pass-the-hash with the service account hash

Use AS-REP roasting to obtain the service account password

Forge a silver ticket for the SQL Server service using the service account hash

Forge a golden ticket using the KRBTGT hash

A penetration tester has local administrator access on a domain controller. The tester wants to ensure that a backdoor password works for any user in the domain, but the tester is concerned about the backdoor being removed if the domain controller is rebooted. What should the tester do?

Use the DCSync attack to extract hashes

Use the skeleton key attack and also create a scheduled task to re-inject the backdoor after reboot

Modify the AdminSDHolder ACL to grant DCSync rights

Use the golden ticket attack instead

In a Pass-the-Hash attack, what does the attacker use to authenticate to remote systems?

The NTLM password hash of a user account

A certificate from the domain CA

A penetration tester has obtained a low-privileged domain user account. During enumeration, the tester finds several service accounts with Service Principal Names (SPNs) registered. The tester wants to obtain plaintext credentials for one of these service accounts without generating excessive event log noise. Which technique should the tester use?

Use the skeleton key attack to authenticate as the service account

Inject a SID History attribute into the service account

Request a service ticket for the SPN and crack it offline

Perform a DCSync attack to replicate the service account hash

What is the main advantage of using GPOs for persistence?

It is undetectable by security tools

It allows execution of malicious code across many machines at once

It does not require any administrative privileges

It only affects the domain controller

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 10)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 46–50

46application · medium
A tester has compromised the hash of a service account that runs the SQL Server service. The tester wants to access the SQL Server database without interacting with the domain controller. Which technique is most appropriate?
Select an answer first
47application · medium
A penetration tester has local administrator access on a domain controller. The tester wants to ensure that a backdoor password works for any user in the domain, but the tester is concerned about the backdoor being removed if the domain controller is rebooted. What should the tester do?
Select an answer first
48foundation · easy
In a Pass-the-Hash attack, what does the attacker use to authenticate to remote systems?
Select an answer first
49application · medium
A penetration tester has obtained a low-privileged domain user account. During enumeration, the tester finds several service accounts with Service Principal Names (SPNs) registered. The tester wants to obtain plaintext credentials for one of these service accounts without generating excessive event log noise. Which technique should the tester use?
Select an answer first
50foundation · easy
What is the main advantage of using GPOs for persistence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.