What is the primary purpose of a Golden Ticket attack?

To disable Kerberos pre-authentication for all users

To gain persistent, domain-wide access by forging TGTs

To crack service account passwords offline

To extract the NTLM hashes of all domain users

During a cross-forest migration, a penetration tester has compromised a domain admin account in the source domain. The tester wants to maintain administrative access to resources in the target domain after the migration is complete. Which technique is most effective?

Create a silver ticket for the target domain's CIFS service

Modify the AdminSDHolder ACL in the target domain

Forge a golden ticket for the target domain using the KRBTGT hash

Add the Domain Admins SID of the source domain to a user's SID History

How can an attacker use Group Policy Objects (GPOs) for persistence?

By disabling Kerberos pre-authentication via GPO

By creating a new domain admin user via GPO

By creating a GPO that runs a malicious script on domain-joined machines

By modifying the KRBTGT account's password

A penetration tester is assessing a multi-domain forest. The tester has compromised a domain admin in Domain A and wants to gain access to Domain B. The trust relationship between Domain A and Domain B is a one-way trust where Domain A trusts Domain B. What is the most effective way to compromise Domain B?

Perform a DCSync attack on Domain B

Use the skeleton key attack on Domain B's domain controller

Use the trust relationship to request a TGT for Domain B using the inter-realm trust key

Forge a golden ticket for Domain B using the KRBTGT hash of Domain A

A penetration tester has domain admin privileges and wants to maintain access to a specific server by modifying its local administrator password. The tester wants to avoid detection by not creating new accounts. Which technique should the tester use?

Modify the AdminSDHolder ACL to grant the tester's account DCSync rights

Perform a DCSync attack to extract the server's local account hash

Forge a silver ticket for the server's service

Create a GPO that changes the local administrator password on the server

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 2)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 6–10

6foundation · easy
What is the primary purpose of a Golden Ticket attack?
Select an answer first
7expert · hard
During a cross-forest migration, a penetration tester has compromised a domain admin account in the source domain. The tester wants to maintain administrative access to resources in the target domain after the migration is complete. Which technique is most effective?
Select an answer first
8foundation · easy
How can an attacker use Group Policy Objects (GPOs) for persistence?
Select an answer first
9expert · hard
A penetration tester is assessing a multi-domain forest. The tester has compromised a domain admin in Domain A and wants to gain access to Domain B. The trust relationship between Domain A and Domain B is a one-way trust where Domain A trusts Domain B. What is the most effective way to compromise Domain B?
Select an answer first
10application · medium
A penetration tester has domain admin privileges and wants to maintain access to a specific server by modifying its local administrator password. The tester wants to avoid detection by not creating new accounts. Which technique should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.