Kerberos Attacks GPEN Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   You are performing Kerberoasting in an environment where the domain controller has AES enabled, but you want to maximize the speed of offline cracking. You have the ability to modify the encryption types supported by your test client. Which encryption type should you request for the service ticket?

   • ADES (etype 1)
   • BAES-128 (etype 17)
   • CRC4 (etype 23)
   • DAES-256 (etype 18)
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the key difference between a Golden Ticket and a Silver Ticket attack?

   • AA Golden Ticket requires the KRBTGT hash, while a Silver Ticket requires the domain admin hash
   • BA Golden Ticket forges a TGT, while a Silver Ticket forges a service ticket
   • CA Golden Ticket requires access to the domain controller, while a Silver Ticket does not
   • DA Golden Ticket only works for a single service, while a Silver Ticket works for all services
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   Your organization wants to mitigate Kerberoasting, AS-REP roasting, and downgrade attacks. You have a mix of legacy and modern systems. Which set of mitigations provides the best balance of security and compatibility?

   • AUse group managed service accounts (gMSAs) and monitor for Kerberos events, but keep RC4 enabled.
   • BDisable preauthentication for all accounts to simplify authentication, but use strong passwords.
   • CDisable RC4, enforce strong passwords for service accounts, and ensure preauthentication is enabled.
   • DKeep RC4 enabled for legacy compatibility, but use long random passwords for service accounts.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary tool used to crack Kerberos tickets offline?

   • ANmap
   • BMimikatz
   • Chashcat
   • DWireshark
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You are troubleshooting a user's inability to access a network share. The user can authenticate to the domain but receives an access denied error when accessing the share. You suspect a Kerberos issue. Which exchange is most likely failing?

   • AThe AP-REQ exchange between the client and the file server
   • BThe AS-REQ exchange between the client and the domain controller
   • CThe TGS-REQ exchange between the client and the domain controller
   • DThe TGS-REP exchange between the domain controller and the file server
   Reveal Solution Discussion Select an answer first