What information is typically contained within a Kerberos Ticket-Granting Ticket (TGT)?

The user's password hash and group memberships

The user's identity, session key, and validity period

The KDC's certificate and public key

The target service's SPN and encrypted timestamp

You have captured a Kerberoast hash from a service ticket and an AS-REP hash from an account with preauthentication disabled. You want to crack both using hashcat. Which hash mode should you use for each?

Mode 13100 for the Kerberoast hash and mode 18200 for the AS-REP hash

Mode 18200 for the Kerberoast hash and mode 13100 for the AS-REP hash

Your organization has been the victim of Kerberoasting and AS-REP roasting attacks. You need to implement mitigations to reduce the risk of these attacks. Which combination of measures is most effective?

Use group managed service accounts (gMSAs) with long random passwords and ensure no accounts have 'Do not require Kerberos preauthentication' enabled

Set service account passwords to never expire and enable preauthentication for all accounts

Monitor for Kerberos service ticket requests and disable RC4 encryption

Use strong, unique passwords for service accounts and disable preauthentication for accounts that require it

What type of data is extracted from a Kerberos ticket for offline cracking?

The plaintext password stored in the ticket

The encrypted portion of the ticket that contains the password hash

Your domain currently supports RC4 and AES encryption types. You are concerned about Kerberos downgrade attacks. You want to disable RC4 while maintaining compatibility with legacy systems. Which approach best balances security and compatibility?

Enable Kerberos armoring to prevent downgrade attacks

Keep RC4 enabled but enforce AES for all new accounts

Disable RC4 only for privileged accounts and leave it enabled for standard users

Disable RC4 for all accounts and monitor for authentication failures

GIAC Penetration Tester (GPEN)

Domain 4Objective 1

Kerberos Attacks GPEN Practice Questions (Page 3)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

12concepts

Questions 11–15

11foundation · easy
What information is typically contained within a Kerberos Ticket-Granting Ticket (TGT)?
Select an answer first
12application · medium
You have captured a Kerberoast hash from a service ticket and an AS-REP hash from an account with preauthentication disabled. You want to crack both using hashcat. Which hash mode should you use for each?
Select an answer first
13application · medium
Your organization has been the victim of Kerberoasting and AS-REP roasting attacks. You need to implement mitigations to reduce the risk of these attacks. Which combination of measures is most effective?
Select an answer first
14foundation · easy
What type of data is extracted from a Kerberos ticket for offline cracking?
Select an answer first
15expert · hard
Your domain currently supports RC4 and AES encryption types. You are concerned about Kerberos downgrade attacks. You want to disable RC4 while maintaining compatibility with legacy systems. Which approach best balances security and compatibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.