What is the primary output of an AS-REP roasting attack that is later cracked offline?

A TGT encrypted with the user's password hash

An AS-REP hash (often in hashcat format 18200)

What is the primary goal of a password spraying attack?

To try many passwords against a single account

To crack password hashes offline

To try a few common passwords against many accounts

You have compromised the hash of the SQL Server service account. You need to access the SQL Server service on a specific server without contacting the domain controller. Which technique should you use?

Forge a Silver Ticket for the SQL service using the service account's hash.

Forge a Golden Ticket using the KRBTGT hash.

Use Pass-the-Hash with the service account's NTLM hash.

Perform a Kerberoasting attack to request a TGS for the SQL service.

You have local administrator access to a workstation and need to extract credentials from memory to move laterally. Which technique is most appropriate?

Use DCSync to replicate credentials from the domain controller.

Use AS-REP roasting to retrieve hashes from the domain.

Dump the LSASS process memory and parse it for credentials.

Use Kerberoasting to obtain service account hashes.

GIAC Red Team Professional

Domain 3Objective 2

Leveraging the Domain GRTP Practice Questions (Page 3)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

25concepts

Questions 11–15

11foundation · easy
What is the primary output of an AS-REP roasting attack that is later cracked offline?
Select an answer first
12foundation · easy
What is the primary goal of a password spraying attack?
Select an answer first
13application · medium
You have compromised the hash of the SQL Server service account. You need to access the SQL Server service on a specific server without contacting the domain controller. Which technique should you use?
Select an answer first
14application · medium
You have local administrator access to a workstation and need to extract credentials from memory to move laterally. Which technique is most appropriate?
Select an answer first
15foundation · easy
Which PowerShell cmdlet is commonly used to execute commands on remote systems via WinRM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.