In an AS-REP roasting attack, what does the attacker obtain from the domain controller?

A TGS ticket encrypted with the service account's password hash

A copy of the NTDS.dit database

An AS-REP message containing encrypted data that can be cracked offline

You have compromised a server that is configured for constrained delegation with protocol transition to a file server. You have the NTLM hash of a user who is a local administrator on the file server. You need to access the file server as that user. Which technique is most appropriate?

Use a silver ticket to forge a service ticket for the file server using the user's NTLM hash.

Use overpass-the-hash to convert the user's NTLM hash into a TGT and then use that TGT to access the file server directly.

Use the compromised server's constrained delegation to request a service ticket for the file server on behalf of the user, using the user's NTLM hash to authenticate via protocol transition.

Use pass-the-hash with the user's NTLM hash to authenticate directly to the file server.

You are performing Kerberoasting and AS-REP roasting in a domain where the security team monitors for event ID 4769 (Kerberos service ticket requested) with a threshold on the number of requests per account. You need to minimize the chance of triggering an alert while still obtaining hashes for both types of accounts. Which approach is most effective?

Request service tickets for all SPN accounts in a short time window and then crack them offline; separately request AS-REP tickets for pre-auth disabled accounts.

Use DCSync to extract all hashes directly from the domain controller, avoiding Kerberos requests altogether.

Use a silver ticket to forge service tickets for the target services instead of requesting them, avoiding 4769 events entirely.

Spread the Kerberoasting requests over several days, using a low number of requests per day, and perform AS-REP roasting only once for each target account.

You have compromised a workstation and obtained the NTLM hash of a domain user who has local admin rights on a target server. The target server is not configured to allow delegation, and you want to authenticate to it without knowing the plaintext password. Which technique should you use?

Crack the NTLM hash offline to recover the plaintext password.

Use the NTLM hash directly in an SMB authentication attempt to the target server.

Request a TGT using the NTLM hash and then use the TGT to access the server.

Convert the NTLM hash to a Kerberos ticket using overpass-the-hash.

Which permission on a user object would allow an attacker to reset that user's password?

WriteProperty (on specific attributes)

GIAC Red Team Professional

Domain 3Objective 1

Attacking Active Directory GRTP Practice Questions (Page 9)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

19concepts

Questions 41–45

41foundation · easy
In an AS-REP roasting attack, what does the attacker obtain from the domain controller?
Select an answer first
42expert · hard
You have compromised a server that is configured for constrained delegation with protocol transition to a file server. You have the NTLM hash of a user who is a local administrator on the file server. You need to access the file server as that user. Which technique is most appropriate?
Select an answer first
43expert · hard
You are performing Kerberoasting and AS-REP roasting in a domain where the security team monitors for event ID 4769 (Kerberos service ticket requested) with a threshold on the number of requests per account. You need to minimize the chance of triggering an alert while still obtaining hashes for both types of accounts. Which approach is most effective?
Select an answer first
44application · medium
You have compromised a workstation and obtained the NTLM hash of a domain user who has local admin rights on a target server. The target server is not configured to allow delegation, and you want to authenticate to it without knowing the plaintext password. Which technique should you use?
Select an answer first
45foundation · easy
Which permission on a user object would allow an attacker to reset that user's password?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.