What is the key difference between pass-the-hash and overpass-the-hash attacks?

Overpass-the-hash converts an NTLM hash into a Kerberos TGT, while pass-the-hash uses the hash directly for NTLM authentication

Pass-the-hash works only on Linux, while overpass-the-hash works only on Windows

Pass-the-hash is used for lateral movement, while overpass-the-hash is used for privilege escalation

Overpass-the-hash requires plaintext passwords, while pass-the-hash does not

Which of the following is a primary purpose of enumerating Active Directory objects during a red team engagement?

To identify potential attack paths and high-value targets such as domain admins

To perform a denial-of-service attack against the domain

To disable security controls on domain controllers

To install backdoors on all workstations

Which type of account is typically targeted in a Kerberoasting attack?

User accounts with Kerberos pre-authentication disabled

Service accounts that have Service Principal Names (SPNs) registered

Built-in administrator accounts

Machine accounts of domain controllers

You have compromised a service account that runs a web application on a server. You need to access a database server that the service account is allowed to connect to, but you do not want to interact with the domain controller for a service ticket. Which attack should you use?

Use pass-the-ticket with a TGT from the service account to access the database server.

Forge a silver ticket for the database server's SPN using the service account's hash.

Perform a Kerberoasting attack to request a TGS for the database server's SPN and crack it offline.

Use DCSync to replicate the database server's computer account hash and use it to authenticate.

What is the purpose of defensive evasion in an Active Directory attack?

To avoid detection by security controls such as EDR, SIEM, and auditing

To disable all security features on the target system

To delete all logs from the domain controller

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 3)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 11–15

11foundation · easy
What is the key difference between pass-the-hash and overpass-the-hash attacks?
Select an answer first
12foundation · easy
Which of the following is a primary purpose of enumerating Active Directory objects during a red team engagement?
Select an answer first
13foundation · easy
Which type of account is typically targeted in a Kerberoasting attack?
Select an answer first
14application · medium
You have compromised a service account that runs a web application on a server. You need to access a database server that the service account is allowed to connect to, but you do not want to interact with the domain controller for a service ticket. Which attack should you use?
Select an answer first
15foundation · easy
What is the purpose of defensive evasion in an Active Directory attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.