What is the attacker able to obtain from an AS-REP Roasting attack?

A crackable hash of the user's password

A list of all accounts with pre-authentication disabled

Which of the following is an example of ACL-based persistence in Active Directory?

Adding a user to the Remote Desktop Users group

Granting a user the 'Replicating Directory Changes' right

A penetration tester has captured an NTLM hash of a domain admin account from a compromised workstation. The tester wants to access a file server using this hash without cracking it. Which technique should the tester use?

Use the hash to perform a DCSync attack

Use the hash to forge a golden ticket

Use the hash to inject a SID History into the admin account

Use the hash in a pass-the-hash attack to authenticate to the file server

What does a DCSync attack mimic to extract password hashes from Active Directory?

LDAP queries for user attributes

What is the primary purpose of a DCSync attack?

To disable the domain controller's security logs

To extract password hashes for offline cracking or pass-the-hash

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 6)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 26–30

26foundation · easy
What is the attacker able to obtain from an AS-REP Roasting attack?
Select an answer first
27foundation · easy
Which of the following is an example of ACL-based persistence in Active Directory?
Select an answer first
28application · medium
A penetration tester has captured an NTLM hash of a domain admin account from a compromised workstation. The tester wants to access a file server using this hash without cracking it. Which technique should the tester use?
Select an answer first
29foundation · easy
What does a DCSync attack mimic to extract password hashes from Active Directory?
Select an answer first
30foundation · easy
What is the primary purpose of a DCSync attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.