How can Group Policy Objects (GPOs) be abused to escalate privileges in an Active Directory environment?

By changing the KRBTGT password

By deleting all GPOs to disable security settings

By creating a new domain controller

By modifying a GPO to add a user to a privileged group or run a malicious script

You have obtained the NTLM hash of a domain user who is a local administrator on a target server. The target server has SMB signing enforced, and you need to authenticate using Kerberos to avoid NTLM relay restrictions. Which technique should you use?

Use overpass-the-hash to convert the NTLM hash into a Kerberos TGT and then request a service ticket for the target server.

Use a silver ticket to forge a service ticket for the target server using the user's NTLM hash.

Use pass-the-hash directly with the NTLM hash to authenticate to the target server via SMB.

Use pass-the-ticket with a TGT you already have from another user to access the target server.

You have a low-privileged domain account and need to obtain password material for accounts that do not require Kerberos pre-authentication. You want to avoid any interaction with the target accounts' passwords. Which technique should you use?

Enumerate all accounts in the domain and attempt to log in with a null session to extract password hashes.

Perform a Kerberoasting attack by requesting service tickets for all accounts with SPNs.

Request AS-REP tickets for accounts with the 'Do not require Kerberos pre-authentication' flag set, then crack the encrypted timestamp offline.

Use a pass-the-hash attack with a known NTLM hash to authenticate as the target account.

What is the primary goal of lateral movement in an Active Directory environment?

To move from one compromised system to another to gain higher privileges or access sensitive data

To perform initial reconnaissance of the network

To install a backdoor for persistence

To exfiltrate data from the network

Which statement correctly describes the relationship between domains, trees, and forests in Active Directory?

A domain is a collection of one or more forests that share a common schema

A tree is a collection of one or more forests that share a contiguous namespace

A forest is a collection of one or more trees that share a common schema and global catalog

A tree is a collection of one or more domains that do not share a contiguous namespace

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 8)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 36–40

36foundation · easy
How can Group Policy Objects (GPOs) be abused to escalate privileges in an Active Directory environment?
Select an answer first
37application · medium
You have obtained the NTLM hash of a domain user who is a local administrator on a target server. The target server has SMB signing enforced, and you need to authenticate using Kerberos to avoid NTLM relay restrictions. Which technique should you use?
Select an answer first
38application · medium
You have a low-privileged domain account and need to obtain password material for accounts that do not require Kerberos pre-authentication. You want to avoid any interaction with the target accounts' passwords. Which technique should you use?
Select an answer first
39foundation · easy
What is the primary goal of lateral movement in an Active Directory environment?
Select an answer first
40foundation · easy
Which statement correctly describes the relationship between domains, trees, and forests in Active Directory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.