What is a common persistence technique using Group Policy?

Deleting the default domain policy

Creating a scheduled task via GPO that runs a malicious payload

Changing the domain functional level

Disabling the Group Policy service on all machines

You are performing an internal penetration test. You have a low-privileged domain account and have enumerated accounts with the 'Do not require Kerberos pre-authentication' flag set. You need to obtain a password hash for one of these accounts without generating failed logon events. Which technique should you use?

Enumerate the account's password via LDAP queries.

Use a pass-the-hash attack with a known NTLM hash from another account.

Perform a Kerberoasting attack by requesting a service ticket for the account's SPN.

Send an AS-REQ without pre-authentication to the domain controller and capture the encrypted timestamp for offline cracking.

What is the purpose of modifying the adminSDHolder object in Active Directory?

To create a new domain controller

To maintain persistence by controlling the permissions of all protected groups

To disable Kerberos pre-authentication

You have compromised a domain-joined server and extracted a Kerberos TGT for a user who has administrative privileges on a target file server. You need to access the file server without knowing the user's password. Which technique should you use?

Use the TGT to perform a DCSync attack and extract the file server's local SAM hashes.

Inject the TGT into your current logon session and request a service ticket for the file server's SPN.

Convert the TGT into an NTLM hash using overpass-the-hash and then use pass-the-hash to access the file server.

Use the TGT to reset the file server's local administrator password via the SAMR protocol.

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 11)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 51–55

51foundation · easy
What is a common persistence technique using Group Policy?
Select an answer first
52application · medium
You are performing an internal penetration test. You have a low-privileged domain account and have enumerated accounts with the 'Do not require Kerberos pre-authentication' flag set. You need to obtain a password hash for one of these accounts without generating failed logon events. Which technique should you use?
Select an answer first
53foundation · easy
What is the purpose of modifying the adminSDHolder object in Active Directory?
Select an answer first
54application · medium
You have compromised a domain-joined server and extracted a Kerberos TGT for a user who has administrative privileges on a target file server. You need to access the file server without knowing the user's password. Which technique should you use?
Select an answer first
55foundation · easy
Which authentication protocol used in Active Directory environments relies on a challenge-response mechanism and does not use tickets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.

Attacking Active Directory GRTP Practice Questions (Page 11)

Questions 51–55

What is a common persistence technique using Group Policy?

What is the purpose of modifying the adminSDHolder object in Active Directory?

You have compromised a domain-joined server and extracted a Kerberos TGT for a user who has administrative privileges on a target file server. You need to access the file server without knowing the user's password. Which technique should you use?

Which authentication protocol used in Active Directory environments relies on a challenge-response mechanism and does not use tickets?

Keep studying — Active Directory Attacks and Post-Exploitation