During an internal penetration test, a tester discovers that a user account has the 'Do not require Kerberos pre-authentication' option enabled. The tester has no credentials for this account but has network access to the domain. What is the most effective way to obtain a crackable hash for this account?

Send an AS-REQ without pre-authentication and capture the encrypted timestamp

Perform a pass-the-hash attack using a captured NTLM hash

Request a TGS for an SPN registered to the account

Modify the account's ACL to grant DCSync rights

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 11)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 51–51

51application · medium
During an internal penetration test, a tester discovers that a user account has the 'Do not require Kerberos pre-authentication' option enabled. The tester has no credentials for this account but has network access to the domain. What is the most effective way to obtain a crackable hash for this account?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 11)

Questions 51–51

Keep studying — Active Directory Attacks