You have compromised a server that is configured for unconstrained delegation. You need to impersonate a domain user who is connecting to a service on another server. The user's TGT is cached in memory on the compromised server. Which technique should you use?

Use a golden ticket using the KRBTGT hash.

Use a silver ticket for the target service using the service account's hash.

Extract the cached TGT from the compromised server's memory and use it to request service tickets for the target service.

Use a skeleton key on the target server to authenticate as the user.

You have compromised a domain controller and want to establish persistence that survives the KRBTGT password being reset and the domain controller being restored from a known-good backup. Which persistence mechanism is most resilient?

Create a golden ticket using the current KRBTGT hash and store it for future use.

Modify the adminSDHolder object's ACL to grant your account full control over protected groups.

Inject SID history into your account to add Domain Admin privileges.

Install a skeleton key on the domain controller to allow authentication as any user with a single password.

What is the primary goal of a Kerberoasting attack?

To capture NTLM hashes by sniffing network traffic

To obtain password hashes of service accounts by requesting service tickets and cracking them offline

To extract the KRBTGT account hash for forging golden tickets

To disable Kerberos pre-authentication for all user accounts

You have compromised a workstation and obtained the NTLM hash of a local administrator account that is also used on several other workstations in the same workgroup (not domain-joined). You need to move laterally to those workstations. Which technique is most appropriate?

Use DCSync to replicate the SAM database from the other workstations to extract their local hashes.

Use overpass-the-hash to convert the NTLM hash into a Kerberos TGT and then use it to access the other workstations.

Use pass-the-ticket by injecting the Kerberos TGT obtained from the compromised workstation into the other workstations' sessions.

Use pass-the-hash with the NTLM hash to authenticate to the other workstations via SMB or other NTLM-based protocols.

You are troubleshooting why a pass-the-hash attack is failing against a target server that is domain-joined. The target server has SMB signing enforced, and NTLM authentication is disabled. Which technique should you use instead?

Use pass-the-ticket with a TGT you have from another user to access the target server.

Use overpass-the-hash to convert the NTLM hash into a Kerberos TGT and then use Kerberos to authenticate to the target server.

Use a silver ticket to forge a service ticket for the target server using the user's NTLM hash.

Use pass-the-hash with the NTLM hash over SMB, but disable SMB signing on the target server first.

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 10)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 46–50

46expert · hard
You have compromised a server that is configured for unconstrained delegation. You need to impersonate a domain user who is connecting to a service on another server. The user's TGT is cached in memory on the compromised server. Which technique should you use?
Select an answer first
47expert · hard
You have compromised a domain controller and want to establish persistence that survives the KRBTGT password being reset and the domain controller being restored from a known-good backup. Which persistence mechanism is most resilient?
Select an answer first
48foundation · easy
What is the primary goal of a Kerberoasting attack?
Select an answer first
49application · medium
You have compromised a workstation and obtained the NTLM hash of a local administrator account that is also used on several other workstations in the same workgroup (not domain-joined). You need to move laterally to those workstations. Which technique is most appropriate?
Select an answer first
50application · medium
You are troubleshooting why a pass-the-hash attack is failing against a target server that is domain-joined. The target server has SMB signing enforced, and NTLM authentication is disabled. Which technique should you use instead?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.