GIAC Red Team Professional
Domain 3Objective 1
Attacking Active Directory GRTP Practice Questions (Page 4)
Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)
61questions here
13free pages
19concepts
Questions 16–20
- 16
What is SID history injection used for in Active Directory persistence?
Select an answer first - 17
Which type of Kerberos ticket, if captured, allows an attacker to request service tickets for any service as the impersonated user?
Select an answer first - 18
During an engagement, you have obtained a low-privileged foothold in a Windows domain. You need to extract credentials for a service account that runs a custom web application under a domain account with a service principal name (SPN). The service account is a member of the 'Web Admins' group, which has local admin rights on several servers. You want to avoid generating excessive noise that might trigger account lockout or alert on failed logons. Which approach best achieves your objective?
Select an answer first - 19
Which tool is commonly used for Active Directory enumeration to query objects such as users, groups, and computers via LDAP?
Select an answer first - 20
What is the main advantage of a pass-the-hash (PtH) attack over attempting to crack a password hash?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.