In a Kerberos authentication flow, what is the primary role of the Ticket Granting Service (TGS)?

To maintain a list of revoked certificates for smart card authentication

To store the master keys used for encrypting all Kerberos tickets

To issue service tickets to clients that allow access to specific services

To authenticate users by verifying their password hash against the SAM database

What is the purpose of a skeleton key attack in Active Directory?

To install a backdoor on domain controllers that allows authentication as any user with a single password

To create a golden ticket for domain-wide access

To extract password hashes from the NTDS.dit file

To disable Kerberos pre-authentication for all users

You have compromised an account that has write access to a Group Policy Object (GPO) linked to an organizational unit containing high-value servers. You need to gain local admin on those servers. Which technique should you use?

Use DCSync to replicate the GPO and extract hashes.

Use Kerberoasting to extract a service account hash from the GPO.

Use a golden ticket to access the servers.

Modify the GPO to add a scheduled task that runs a command to add your account to the local administrators group.

Which privilege is required to perform a DCSync attack?

Local Administrator on a domain controller

Replicating Directory Changes and Replicating Directory Changes All

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 6)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 26–30

26foundation · easy
In a Kerberos authentication flow, what is the primary role of the Ticket Granting Service (TGS)?
Select an answer first
27foundation · easy
What is the purpose of a skeleton key attack in Active Directory?
Select an answer first
28foundation · easy
Which of the following is a common lateral movement technique in Active Directory?
Select an answer first
29application · medium
You have compromised an account that has write access to a Group Policy Object (GPO) linked to an organizational unit containing high-value servers. You need to gain local admin on those servers. Which technique should you use?
Select an answer first
30foundation · easy
Which privilege is required to perform a DCSync attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.