A penetration tester has gained low-privileged access to a workstation in a corporate domain. The tester discovers a service account with a Service Principal Name (SPN) registered for a legacy application. The tester wants to escalate privileges by obtaining the service account's password hash. Which approach should the tester use?

Inject a skeleton key into the domain controller to authenticate as the service account

Request a Kerberos service ticket for the SPN and crack it offline

Extract the hash from the local SAM database and use pass-the-hash

Enumerate accounts with 'Do not require Kerberos pre-authentication' and request an AS-REP

Which condition makes an Active Directory account vulnerable to AS-REP Roasting?

The account has a weak password policy

The account is a member of the Domain Admins group

The account has a Service Principal Name (SPN) set

Kerberos pre-authentication is disabled on the account

A penetration tester has local administrator access on a domain controller. The tester wants to maintain access to the domain by allowing authentication as any user with a single password, but the tester is concerned about the attack being detected by memory scanning. Which technique should the tester use?

ACL-based persistence by modifying AdminSDHolder

A penetration tester has compromised an account with DCSync rights. The tester wants to maintain DCSync rights even if the account's permissions are revoked. Which action should the tester take?

Create a new domain admin account

Use the skeleton key attack on the domain controller

Modify the AdminSDHolder ACL to grant DCSync rights to another controlled account

Forge a golden ticket using the KRBTGT hash

A penetration tester has compromised a domain controller and extracted the KRBTGT hash and a service account hash for the CIFS service. The tester wants to maintain access to a file server without relying on the domain controller being available. Which technique is most appropriate?

Use pass-the-hash with the KRBTGT hash

Forge a silver ticket for the CIFS service on the file server

Inject a skeleton key into the file server

Forge a golden ticket for the domain

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 8)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 36–40

36application · medium
A penetration tester has gained low-privileged access to a workstation in a corporate domain. The tester discovers a service account with a Service Principal Name (SPN) registered for a legacy application. The tester wants to escalate privileges by obtaining the service account's password hash. Which approach should the tester use?
Select an answer first
37foundation · easy
Which condition makes an Active Directory account vulnerable to AS-REP Roasting?
Select an answer first
38expert · hard
A penetration tester has local administrator access on a domain controller. The tester wants to maintain access to the domain by allowing authentication as any user with a single password, but the tester is concerned about the attack being detected by memory scanning. Which technique should the tester use?
Select an answer first
39expert · hard
A penetration tester has compromised an account with DCSync rights. The tester wants to maintain DCSync rights even if the account's permissions are revoked. Which action should the tester take?
Select an answer first
40expert · hard
A penetration tester has compromised a domain controller and extracted the KRBTGT hash and a service account hash for the CIFS service. The tester wants to maintain access to a file server without relying on the domain controller being available. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 8)

Questions 36–40

Which condition makes an Active Directory account vulnerable to AS-REP Roasting?

A penetration tester has compromised an account with DCSync rights. The tester wants to maintain DCSync rights even if the account's permissions are revoked. Which action should the tester take?

A penetration tester has compromised a domain controller and extracted the KRBTGT hash and a service account hash for the CIFS service. The tester wants to maintain access to a file server without relying on the domain controller being available. Which technique is most appropriate?

Keep studying — Active Directory Attacks