You have compromised a child domain and want to gain access to resources in a parent domain. You have the KRBTGT hash of the child domain. Which technique is most effective?

Forge a TGT with SID history containing the parent domain's Enterprise Admins SID

Use Kerberoasting to obtain hashes from the parent domain

Perform a DCSync attack against the parent domain

Create a new user in the parent domain

Why does password spraying use a small number of passwords?

To increase the chance of cracking hashes

To avoid detection by antivirus

To avoid triggering account lockout policies

You are performing an internal assessment and have a low-privileged domain account. You need to identify accounts that are vulnerable to AS-REP roasting. Which initial step is most effective?

Request service tickets for all SPN accounts and crack them offline.

Perform a password spray against all domain users.

Use DCSync to extract the NTDS.dit database.

Enumerate domain accounts and check the 'Do not require Kerberos preauthentication' attribute.

Which permission is required to perform a DCSync attack?

Read all properties on the domain

What is the purpose of the AdminSDHolder object in Active Directory?

To store default permissions for privileged groups

GIAC Red Team Professional

Domain 3Objective 2

Leveraging the Domain GRTP Practice Questions (Page 6)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

25concepts

25 Concepts in This Objective

Domain Enumeration
Kerberoasting
AS-REP Roasting
Pass-the-Hash
Pass-the-Ticket
Golden Ticket
Silver Ticket
DCSync
AdminSDHolder and SDProp
Group Policy Object (GPO) Abuse
Skeleton Key
ACL-Based Persistence
Domain Trust Exploitation
Lateral Movement via Scheduled Tasks
Lateral Movement via WMI
Lateral Movement via WinRM
Lateral Movement via PsExec
Credential Dumping from LSASS
NTDS.dit Extraction
Password Spraying
Kerberos Delegation Abuse
Privilege Escalation via Misconfigured ACLs
Domain Controller Synchronization (DCSync)
SID History Injection
GPO Link and Enforcement

Questions 26–30

26expert · hard
You have compromised a child domain and want to gain access to resources in a parent domain. You have the KRBTGT hash of the child domain. Which technique is most effective?
Select an answer first
27foundation · easy
Why does password spraying use a small number of passwords?
Select an answer first
28application · medium
You are performing an internal assessment and have a low-privileged domain account. You need to identify accounts that are vulnerable to AS-REP roasting. Which initial step is most effective?
Select an answer first
29foundation · easy
Which permission is required to perform a DCSync attack?
Select an answer first
30foundation · easy
What is the purpose of the AdminSDHolder object in Active Directory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.