Kerberos Attacks GPEN Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which hash is used to forge a Silver Ticket?

   • AThe KRBTGT account's password hash
   • BThe user's password hash
   • CThe domain controller's machine account hash
   • DThe target service account's password hash
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   How does a password spraying attack differ from a traditional brute-force attack?

   • APassword spraying requires a valid TGT, while brute-force does not
   • BPassword spraying uses the AS-REP exchange, while brute-force uses the TGS-REP exchange
   • CPassword spraying tries a few passwords against many accounts, while brute-force tries many passwords against one account
   • DPassword spraying is only effective against service accounts, while brute-force works on any account
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the purpose of the TGS-REP message in Kerberos authentication?

   • AIt delivers a service ticket to the client.
   • BIt requests a Ticket-Granting Ticket from the KDC.
   • CIt authenticates the client to the target service.
   • DIt validates the user's password with the domain controller.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the key difference between constrained delegation and resource-based constrained delegation?

   • AConstrained delegation uses the KRBTGT hash, while resource-based uses the service hash
   • BConstrained delegation requires domain admin privileges, while resource-based does not
   • CConstrained delegation only works for HTTP services, while resource-based works for any service
   • DConstrained delegation is configured on the service account, while resource-based constrained delegation is configured on the resource account
   Reveal Solution Discussion Select an answer first
6. 40expert · hard · select all that apply

   Your organization wants to implement a comprehensive defense against Kerberos attacks, including Kerberoasting, AS-REP roasting, and password spraying. Which of the following measures should you implement? Select all that apply.

   • AImplement account lockout policies with a low threshold
   • BMonitor for Kerberos service ticket requests and AS-REP responses
   • CEnsure no accounts have 'Do not require Kerberos preauthentication' enabled
   • DDisable RC4 encryption and enforce AES
   • EUse group managed service accounts (gMSAs) for all service accounts
   • FSet service account passwords to never expire
   Check answers Discussion Select an answer first