During an assessment, you capture a Kerberos TGT from a compromised workstation used by a domain user. You need to access a file server as that user, but you do not know their password. Which attack should you use?

Pass-the-ticket by injecting the TGT into your session.

Perform Kerberoasting to get a service ticket for the file server.

Crack the TGT offline to recover the user's password.

Perform a golden ticket attack using the KRBTGT hash.

What account setting makes a user vulnerable to AS-REP Roasting?

The account is a member of the Domain Admins group

'Do not require Kerberos preauthentication' is enabled

The account has a weak password policy applied

The account has a Service Principal Name (SPN) set

Which type of Kerberos delegation allows a service to impersonate a user to any service?

Resource-based constrained delegation

During an assessment, you capture a Kerberos TGT from a user's workstation. You want to use this ticket to access a file server as that user. What is the most direct way to use the captured ticket?

Submit the TGT directly to the file server as an AP-REQ

Decrypt the TGT to recover the user's password and log in normally

Use the TGT to forge a silver ticket for the file server

Inject the TGT into your current session and request a service ticket for the file server

Which key encrypts a Kerberos service ticket?

The target service account's key

GIAC Penetration Tester (GPEN)

Domain 4Objective 1

Kerberos Attacks GPEN Practice Questions (Page 4)

Part of the Active Directory Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

12concepts

Questions 16–20

16application · medium
During an assessment, you capture a Kerberos TGT from a compromised workstation used by a domain user. You need to access a file server as that user, but you do not know their password. Which attack should you use?
Select an answer first
17foundation · easy
What account setting makes a user vulnerable to AS-REP Roasting?
Select an answer first
18foundation · easy
Which type of Kerberos delegation allows a service to impersonate a user to any service?
Select an answer first
19application · medium
During an assessment, you capture a Kerberos TGT from a user's workstation. You want to use this ticket to access a file server as that user. What is the most direct way to use the captured ticket?
Select an answer first
20foundation · easy
Which key encrypts a Kerberos service ticket?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.