You have compromised a domain user in a child domain and need to move laterally to a server in the parent domain. The trust relationship is a two-way transitive trust. Which technique is most appropriate?

Use a silver ticket for the parent domain's server using the child domain's KRBTGT hash.

Use pass-the-hash with the child domain user's hash to authenticate directly to the parent domain server.

Use DCSync in the child domain to extract the parent domain's KRBTGT hash and forge a golden ticket for the parent domain.

Use the trust relationship to request a referral ticket from the child domain's KDC to the parent domain's KDC, then request a service ticket for the target server.

Which type of delegation allows a service to impersonate users to any service in the domain?

Resource-based constrained delegation

You have compromised a workstation and obtained the NTLM hash of a domain user. The user has local admin rights on a target server that only allows Kerberos authentication (NTLM is disabled). You need to move laterally to the target server. Which technique should you use?

Use a silver ticket for the target server using the user's NTLM hash.

Use pass-the-hash to authenticate directly over SMB.

Use a golden ticket using the KRBTGT hash.

Use overpass-the-hash to convert the NTLM hash to a Kerberos TGT and then request a service ticket for the target server.

You have compromised an account that has the 'Replicating Directory Changes' and 'Replicating Directory Changes All' permissions on the domain. You need to extract password hashes for all users without logging into any domain controller. Which technique should you use?

Use a golden ticket to forge a TGT for the Domain Admin account and then log into a domain controller to extract hashes.

Use DCSync to impersonate a domain controller and request replication of the directory database from a legitimate DC.

Perform a Kerberoasting attack to request service tickets for all accounts with SPNs and crack them offline.

Use pass-the-hash with the compromised account's hash to authenticate to the domain controller and run ntdsutil.

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 5)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 21–25

21application · medium
You have compromised a domain user in a child domain and need to move laterally to a server in the parent domain. The trust relationship is a two-way transitive trust. Which technique is most appropriate?
Select an answer first
22foundation · easy
Which type of delegation allows a service to impersonate users to any service in the domain?
Select an answer first
23application · medium
You have compromised a workstation and obtained the NTLM hash of a domain user. The user has local admin rights on a target server that only allows Kerberos authentication (NTLM is disabled). You need to move laterally to the target server. Which technique should you use?
Select an answer first
24foundation · easy
Which type of trust is automatically created between a parent and child domain in the same forest?
Select an answer first
25application · medium
You have compromised an account that has the 'Replicating Directory Changes' and 'Replicating Directory Changes All' permissions on the domain. You need to extract password hashes for all users without logging into any domain controller. Which technique should you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.