During an Active Directory assessment, a tester obtains a Kerberos service ticket for a domain admin account by compromising a service account. The tester wants to impersonate that admin to access a database server. Which attack should the tester use?

Credential stuffing with the service account's password

Pass-the-hash by using the service account's NTLM hash

Rainbow table attack on the service ticket

Pass-the-ticket by reusing the captured Kerberos ticket

A tester has a wordlist containing 'password', 'admin', and 'welcome'. The tester wants to generate variations like 'Password1!', 'Admin2024', and 'welcome#1'. Which technique is most appropriate?

Use a brute-force attack with a character set of letters and digits.

Perform a password spraying attack with the original words.

Use a rainbow table for the hash type.

Apply a set of rule-based transformations to the wordlist.

A tester has administrative access to a domain controller and extracts a Kerberos ticket-granting ticket (TGT) for a domain admin. The tester wants to impersonate that admin to access a web application that uses Kerberos authentication. Which technique should the tester use?

Inject the TGT into the current session and use it to request service tickets.

Submit the TGT to a password spraying tool to authenticate to the web app.

Use the TGT as an NTLM hash in a pass-the-hash attack.

Crack the TGT offline to recover the plaintext password.

Which scenario best exemplifies a hybrid attack?

Trying all combinations of letters and digits up to 6 characters.

Taking 'Football' and trying 'Football1', 'Football!', and 'Football2024'.

Using a rainbow table to crack an NTLM hash.

Using a list of previously breached passwords.

A tester is cracking hashes from a company that has a password policy requiring at least one uppercase letter and one number. The tester has a wordlist of lowercase base words. Which Hashcat attack mode is best suited to generate candidates like 'Summer2024'?

Brute-force mode with a mask of ?u?l?l?l?l?l?d?d?d?d

Straight mode with the wordlist

Hybrid mode that appends a mask to each word

Combinator mode that concatenates two words

GIAC Penetration Tester (GPEN)

Domain 3Objective 2

Password Attacks GPEN Practice Questions (Page 6)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 26–30

26application · medium
During an Active Directory assessment, a tester obtains a Kerberos service ticket for a domain admin account by compromising a service account. The tester wants to impersonate that admin to access a database server. Which attack should the tester use?
Select an answer first
27application · medium
A tester has a wordlist containing 'password', 'admin', and 'welcome'. The tester wants to generate variations like 'Password1!', 'Admin2024', and 'welcome#1'. Which technique is most appropriate?
Select an answer first
28application · medium
A tester has administrative access to a domain controller and extracts a Kerberos ticket-granting ticket (TGT) for a domain admin. The tester wants to impersonate that admin to access a web application that uses Kerberos authentication. Which technique should the tester use?
Select an answer first
29foundation · easy
Which scenario best exemplifies a hybrid attack?
Select an answer first
30application · medium
A tester is cracking hashes from a company that has a password policy requiring at least one uppercase letter and one number. The tester has a wordlist of lowercase base words. Which Hashcat attack mode is best suited to generate candidates like 'Summer2024'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.