A penetration tester has domain admin privileges and wants to establish persistence by ensuring a malicious script runs on all domain-joined workstations at the next group policy refresh. Which technique is most appropriate?

Modify the AdminSDHolder ACL to grant the user DCSync rights

Inject a skeleton key into the domain controller

Forge a golden ticket to impersonate the domain admin

Create a new Group Policy Object (GPO) linked to the domain that runs a startup script

What is the primary difference between a Silver Ticket and a Golden Ticket attack?

A Silver Ticket works only on the domain controller, while a Golden Ticket works on any machine

A Silver Ticket forges a service ticket, while a Golden Ticket forges a TGT

A Silver Ticket requires the KRBTGT hash, while a Golden Ticket requires a service account hash

A Silver Ticket is used for persistence, while a Golden Ticket is used for privilege escalation

A penetration tester has compromised a workstation and extracted the NTLM hash of a domain user who is a local administrator on several servers. The tester wants to move laterally to those servers without knowing the plaintext password. Which technique should the tester use?

Kerberoasting to obtain a service ticket for the user

AS-REP roasting to obtain a crackable hash

Skeleton key injection on the domain controller

Pass-the-hash using the NTLM hash to authenticate to the servers

A penetration tester has captured a Kerberos TGT for a domain admin account. The tester wants to access a file server as the domain admin without knowing the password. Which technique should the tester use?

Pass-the-ticket using the captured TGT

Golden ticket attack using the KRBTGT hash

Silver ticket attack using the file server's service account hash

Pass-the-hash using the NTLM hash

A penetration tester has domain admin privileges and wants to maintain persistence by ensuring that a malicious script runs on a specific server every time the server starts. The tester wants to avoid creating a new GPO that might be noticed. Which technique should the tester use?

Modify an existing GPO that applies to the server to include a startup script

Create a new GPO linked to the server's OU

Modify the AdminSDHolder ACL to grant DCSync rights

Forge a silver ticket for the server's service

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 5)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 21–25

21application · medium
A penetration tester has domain admin privileges and wants to establish persistence by ensuring a malicious script runs on all domain-joined workstations at the next group policy refresh. Which technique is most appropriate?
Select an answer first
22foundation · easy
What is the primary difference between a Silver Ticket and a Golden Ticket attack?
Select an answer first
23application · medium
A penetration tester has compromised a workstation and extracted the NTLM hash of a domain user who is a local administrator on several servers. The tester wants to move laterally to those servers without knowing the plaintext password. Which technique should the tester use?
Select an answer first
24application · medium
A penetration tester has captured a Kerberos TGT for a domain admin account. The tester wants to access a file server as the domain admin without knowing the password. Which technique should the tester use?
Select an answer first
25application · medium
A penetration tester has domain admin privileges and wants to maintain persistence by ensuring that a malicious script runs on a specific server every time the server starts. The tester wants to avoid creating a new GPO that might be noticed. Which technique should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.