What is the primary purpose of Kerberoasting from an attacker's perspective?

To enumerate all SPNs in the domain

To extract service account credentials by cracking service tickets

To disable Kerberos pre-authentication for all users

To impersonate the domain controller in Kerberos exchanges

A penetration tester has compromised the service account for a web application that runs on a specific server. The tester wants to forge a service ticket to access the web application's database service without needing the database service account's password. What is the most appropriate attack?

Kerberoasting to crack the database service account password

Silver ticket attack using the service account's hash

Golden ticket attack using the KRBTGT hash

Pass-the-ticket using a captured TGT

What is the main persistence benefit of a Skeleton Key attack?

It allows authentication as any user with a single password

It disables Kerberos pre-authentication for all users

It creates a new domain admin account

A penetration tester has compromised an account with Replicating Directory Changes permissions but not domain admin. The tester wants to extract password hashes for all domain users to facilitate further attacks. Which technique should the tester use?

Perform a DCSync attack to mimic domain controller replication

Kerberoast all SPN-registered accounts

Inject a skeleton key to authenticate as any user

Forge a golden ticket to impersonate the domain admin

GIAC Penetration Tester (GPEN)

Domain 4Objective 2

Domain Escalation and Persistence Attacks GPEN Practice Questions (Page 9)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

12concepts

Questions 41–45

41foundation · easy
What is the primary purpose of Kerberoasting from an attacker's perspective?
Select an answer first
42application · medium
A penetration tester has compromised the service account for a web application that runs on a specific server. The tester wants to forge a service ticket to access the web application's database service without needing the database service account's password. What is the most appropriate attack?
Select an answer first
43foundation · easy
What is the main persistence benefit of a Skeleton Key attack?
Select an answer first
44application · medium
A penetration tester has obtained credentials for an account that has 'Replicating Directory Changes' and 'Replicating Directory Changes All' permissions. The tester wants to extract password hashes for all users in the domain. Which attack should the tester perform?
Select an answer first
45application · medium
A penetration tester has compromised an account with Replicating Directory Changes permissions but not domain admin. The tester wants to extract password hashes for all domain users to facilitate further attacks. Which technique should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.