What is the purpose of SID History injection in an Active Directory attack?

To add privileged SIDs to a user account to escalate privileges

To disable SID filtering between domains

What is the key difference between Pass-the-Hash and Pass-the-Ticket attacks?

Pass-the-Hash uses NTLM hashes, while Pass-the-Ticket uses Kerberos tickets

Pass-the-Hash is used for lateral movement, while Pass-the-Ticket is used for persistence

Pass-the-Hash only works on Linux, while Pass-the-Ticket only works on Windows

Pass-the-Hash requires domain admin rights, while Pass-the-Ticket does not

A penetration tester has obtained the KRBTGT account hash and the domain SID during an assessment. The tester wants to maintain persistent domain-wide access even after the current domain admin account is disabled. Which action best achieves this persistence?

Perform a DCSync attack to extract all hashes

Create a silver ticket for the CIFS service on a file server

Forge a golden ticket for a fake user with domain admin privileges

Inject a skeleton key into the domain controller

Which of the following is a common privilege escalation vector in an Active Directory domain that a standard user might exploit to gain domain administrator access?

Enabling SMB signing on all domain controllers

Changing the password of a domain admin user via the helpdesk portal

Disabling the Windows Defender firewall on a client machine

Exploiting a misconfigured service account with Kerberoastable credentials

In which scenario is SID History injection commonly used for persistence?

In a cloud-only Azure AD environment

Within a single domain without any trust relationships

Across domain migrations or forest trusts

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 7)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 31–35

31foundation · easy
What is the purpose of SID History injection in an Active Directory attack?
Select an answer first
32foundation · easy
What is the key difference between Pass-the-Hash and Pass-the-Ticket attacks?
Select an answer first
33expert · hard
A penetration tester has obtained the KRBTGT account hash and the domain SID during an assessment. The tester wants to maintain persistent domain-wide access even after the current domain admin account is disabled. Which action best achieves this persistence?
Select an answer first
34foundation · easy
Which of the following is a common privilege escalation vector in an Active Directory domain that a standard user might exploit to gain domain administrator access?
Select an answer first
35foundation · easy
In which scenario is SID History injection commonly used for persistence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.