In a Kerberoasting attack, what type of ticket is requested from the domain controller and later cracked offline?

Ticket-Granting Service (TGS) exchange ticket

Kerberos preauthentication timestamp

You have compromised an account that has GenericAll permission over a user object. You want to maintain persistent administrative access to that user's account without changing the password. Which technique should you use?

Change the user's password to a known value.

Add the user to the Domain Admins group.

Modify the user object's ACL to grant your controlled account Full Control.

Use DCSync to extract the user's hash.

What is a key limitation of the Skeleton Key attack?

It is non-persistent and requires a reboot to remove

It requires physical access to the DC

It only works with Kerberos, not NTLM

You have achieved Domain Admin privileges and extracted the KRBTGT hash. Your goal is to maintain domain-wide persistence even if the KRBTGT password is changed. Which action would provide the most durable persistence?

Modify the AdminSDHolder object to grant yourself Full Control over all protected groups.

Create a Silver Ticket for the domain controller's CIFS service.

Forge a Golden Ticket using the current KRBTGT hash and use it to access any resource.

Perform a DCSync attack to extract all password hashes.

What is Kerberos delegation?

Forwarding tickets to other domains

Allowing a service to impersonate users to access other services

Sharing passwords between services

GIAC Red Team Professional

Domain 3Objective 2

Leveraging the Domain GRTP Practice Questions (Page 2)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

25concepts

Questions 6–10

6foundation · easy
In a Kerberoasting attack, what type of ticket is requested from the domain controller and later cracked offline?
Select an answer first
7application · medium
You have compromised an account that has GenericAll permission over a user object. You want to maintain persistent administrative access to that user's account without changing the password. Which technique should you use?
Select an answer first
8foundation · easy
What is a key limitation of the Skeleton Key attack?
Select an answer first
9expert · hard
You have achieved Domain Admin privileges and extracted the KRBTGT hash. Your goal is to maintain domain-wide persistence even if the KRBTGT password is changed. Which action would provide the most durable persistence?
Select an answer first
10foundation · easy
What is Kerberos delegation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.