A penetration tester has domain admin privileges on a domain controller and wants to maintain access without relying on a forged ticket that could be invalidated by a KRBTGT password reset. The tester wants a backdoor that works for any user. Which technique is most appropriate?

Forge a golden ticket with a long validity period

Modify the AdminSDHolder ACL to grant DCSync rights

Inject a skeleton key into the domain controller's memory

Create a silver ticket for the CIFS service

A penetration tester has standard user access in a domain and discovers an account with pre-authentication disabled. The tester wants to obtain a crackable credential for this account without triggering an account lockout. Which technique should the tester use?

Skeleton key injection to authenticate as the account

Pass-the-hash using a hash extracted from the local SAM

AS-REP roasting to request an AS-REP for the account

Kerberoasting to request a service ticket for the account

A penetration tester is performing an assessment and has a list of domain users. The tester wants to identify accounts that are vulnerable to Kerberoasting and AS-REP roasting. Which accounts should the tester focus on?

Accounts with Kerberos delegation enabled and accounts with smart card required

Accounts with adminCount=1 and accounts with password never expires

Accounts with SPNs registered and accounts with pre-authentication disabled

Accounts with SID History and accounts with DCSync rights

A penetration tester has standard user access in a domain and wants to obtain crackable credentials for a service account that runs a legacy application. The service account has an SPN registered. Which technique should the tester use?

Pass-the-hash using a hash extracted from the local SAM

Kerberoasting to request a service ticket for the SPN

Skeleton key injection to authenticate as the service account

AS-REP roasting to request an AS-REP for the service account

In a Kerberoasting attack, what does the attacker request from the domain controller to obtain crackable material?

A list of all domain users from the SAM database

A certificate for the domain controller

A service ticket for an account with a Service Principal Name (SPN)

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 4)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 16–20

16expert · hard
A penetration tester has domain admin privileges on a domain controller and wants to maintain access without relying on a forged ticket that could be invalidated by a KRBTGT password reset. The tester wants a backdoor that works for any user. Which technique is most appropriate?
Select an answer first
17application · medium
A penetration tester has standard user access in a domain and discovers an account with pre-authentication disabled. The tester wants to obtain a crackable credential for this account without triggering an account lockout. Which technique should the tester use?
Select an answer first
18application · medium
A penetration tester is performing an assessment and has a list of domain users. The tester wants to identify accounts that are vulnerable to Kerberoasting and AS-REP roasting. Which accounts should the tester focus on?
Select an answer first
19application · medium
A penetration tester has standard user access in a domain and wants to obtain crackable credentials for a service account that runs a legacy application. The service account has an SPN registered. Which technique should the tester use?
Select an answer first
20foundation · easy
In a Kerberoasting attack, what does the attacker request from the domain controller to obtain crackable material?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.