What is the primary goal of a Kerberoasting attack?

Capture and replay a user's TGT to impersonate them

Forge a TGT using the KRBTGT hash

Enumerate all users with Kerberos preauthentication disabled

Obtain service tickets and crack them offline to recover service account passwords

Which type of ticket can be used in a Pass-the-Ticket attack?

Only tickets encrypted with RC4

During an internal assessment, you discover a user account with the 'Do not require Kerberos preauthentication' flag set. You have no credentials for this account. Which attack should you perform to obtain a hash that can be cracked offline?

Enumerate the account's SPNs and then perform a silver ticket attack.

Request a TGS for a service principal name associated with the account.

Send an AS-REQ without a timestamp and capture the AS-REP.

Use the account's SID to forge a golden ticket.

As a red teamer, you have compromised a domain controller and obtained the KRBTGT hash. You want to maintain access to the domain for an extended period without recompromising a DC. However, you are concerned about detection by the blue team. Which approach best balances persistence and stealth?

Create a new domain admin account and use it for all future access

Use the KRBTGT hash to reset the password of a privileged user and use that account

Extract the hash of a service account and forge silver tickets for multiple services

Forge a golden ticket with a long validity and use it to access resources, avoiding further DC contact

What is the primary impact of a Golden Ticket attack?

Persistent domain access by forging TGTs

Capturing user passwords through the network

Downgrading Kerberos encryption to weaker ciphers

Access to a single service without contacting the DC

GIAC Penetration Tester (GPEN)

Domain 4Objective 1

Kerberos Attacks GPEN Practice Questions (Page 2)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

12concepts

Questions 6–10

6foundation · easy
What is the primary goal of a Kerberoasting attack?
Select an answer first
7foundation · easy
Which type of ticket can be used in a Pass-the-Ticket attack?
Select an answer first
8application · medium
During an internal assessment, you discover a user account with the 'Do not require Kerberos preauthentication' flag set. You have no credentials for this account. Which attack should you perform to obtain a hash that can be cracked offline?
Select an answer first
9expert · hard
As a red teamer, you have compromised a domain controller and obtained the KRBTGT hash. You want to maintain access to the domain for an extended period without recompromising a DC. However, you are concerned about detection by the blue team. Which approach best balances persistence and stealth?
Select an answer first
10foundation · easy
What is the primary impact of a Golden Ticket attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.