You are mapping an Active Directory forest that contains multiple domains. You need to identify the boundaries of the forest and the trust relationships between domains to plan lateral movement. Which enumeration approach is most effective?

Use Kerberoasting to enumerate all service accounts and infer domain boundaries from SPN suffixes.

Use DNS zone transfers to enumerate all domain names in the forest.

Enumerate only the domain you have access to and assume all other domains are in the same forest.

Enumerate the forest root domain, then enumerate all child domains and their trust relationships using LDAP and the NetApi32 functions.

During an internal penetration test, you have obtained a low-privileged domain user's credentials. You need to identify service accounts that are vulnerable to Kerberoasting without triggering a large number of failed logon events. Which approach is most appropriate?

Enumerate all domain admins and attempt to pass-the-hash with their NTLM hashes to gain access to other systems.

Run a password spraying attack against all domain users using a common password list to find weak passwords.

Enumerate all accounts with Service Principal Names (SPNs) using LDAP queries, then request service tickets for those accounts and crack the hashes offline.

Use DCSync to replicate the NTDS.dit file and extract all password hashes directly from the domain controller.

You have compromised a domain controller and extracted the KRBTGT account hash. You want to maintain persistent access to the domain even after the compromised domain controller is rebuilt. You also want to avoid detection by creating a ticket that is valid for a long period. Which technique should you use?

Install a skeleton key on the domain controller to authenticate as any user.

Forge a silver ticket for a specific service using the service account's hash.

Forge a golden ticket using the KRBTGT hash and set a long validity period.

Use DCSync to extract hashes of all users and use pass-the-hash.

You have compromised a domain controller and extracted the KRBTGT hash. You want to maintain access to the domain without triggering alerts that monitor for unusual TGT requests or logon events. Which technique should you use?

Forge a golden ticket with a long validity period and use it to access resources without generating new TGT requests.

Install a skeleton key on the domain controller.

Use DCSync to extract hashes and perform pass-the-hash attacks.

Use a silver ticket for a specific service.

You have compromised a domain controller and extracted the KRBTGT hash. You want to maintain persistent access to the domain even after the compromised domain controller is rebuilt and the KRBTGT password is reset. Which approach is most effective for long-term persistence?

Create a golden ticket using the current KRBTGT hash and use it to access any resource in the domain until the KRBTGT password is changed.

Modify the adminSDHolder object's ACL to grant your controlled account full control, then wait for the SDProp process to propagate the change to all protected groups.

Install a skeleton key on the domain controller to allow authentication as any user with a single password, and ensure it persists across reboots.

Use the KRBTGT hash to perform a DCSync attack and extract the hash of a privileged user, then use that hash for pass-the-hash.

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 12)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 56–60

56application · medium
You are mapping an Active Directory forest that contains multiple domains. You need to identify the boundaries of the forest and the trust relationships between domains to plan lateral movement. Which enumeration approach is most effective?
Select an answer first
57application · medium
During an internal penetration test, you have obtained a low-privileged domain user's credentials. You need to identify service accounts that are vulnerable to Kerberoasting without triggering a large number of failed logon events. Which approach is most appropriate?
Select an answer first
58expert · hard
You have compromised a domain controller and extracted the KRBTGT account hash. You want to maintain persistent access to the domain even after the compromised domain controller is rebuilt. You also want to avoid detection by creating a ticket that is valid for a long period. Which technique should you use?
Select an answer first
59expert · hard
You have compromised a domain controller and extracted the KRBTGT hash. You want to maintain access to the domain without triggering alerts that monitor for unusual TGT requests or logon events. Which technique should you use?
Select an answer first
60expert · hard
You have compromised a domain controller and extracted the KRBTGT hash. You want to maintain persistent access to the domain even after the compromised domain controller is rebuilt and the KRBTGT password is reset. Which approach is most effective for long-term persistence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.