What is ACL-based persistence in Active Directory?

Creating a new domain admin account

Adding a user to the Domain Admins group

Modifying object ACLs to grant a controlled account administrative rights

During an engagement, you have obtained a low-privileged domain account. Your goal is to gain access to a service account that runs a legacy application. You have identified that the service account has an SPN registered. Which technique would most likely allow you to obtain the service account's password hash for offline cracking?

Enumerate all users and groups to find the service account's password in description fields.

Use DCSync to replicate the service account's hash from the domain controller.

Perform a password spray against the service account using common passwords.

Request a TGS ticket for the SPN and crack it offline.

You have compromised an account that has the ability to create and link GPOs in the domain. You need to execute a command on all workstations in a specific organizational unit (OU). Which approach is most effective?

Use WMI to execute the command on each workstation individually.

Create a GPO that runs a scheduled task at logon and link it to the target OU.

Create a scheduled task on the domain controller to run the command on all workstations.

Use PsExec to run the command on each workstation.

What is the primary purpose of a Golden Ticket attack?

To escalate privileges on a local machine

To maintain persistent domain-wide access

To gain access to a single service

You have compromised a service account that is configured for constrained delegation to a file server. You need to access the file server as a domain administrator. Which technique is most appropriate?

Perform a Kerberoasting attack to obtain the domain administrator's hash.

Forge a Silver Ticket for the file server using the service account's hash.

Use Pass-the-Ticket with a TGT from the domain administrator.

Use the service account to request a service ticket for the file server on behalf of the domain administrator.

GIAC Red Team Professional

Domain 3Objective 2

Leveraging the Domain GRTP Practice Questions (Page 7)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

25concepts

25 Concepts in This Objective

Domain Enumeration
Kerberoasting
AS-REP Roasting
Pass-the-Hash
Pass-the-Ticket
Golden Ticket
Silver Ticket
DCSync
AdminSDHolder and SDProp
Group Policy Object (GPO) Abuse
Skeleton Key
ACL-Based Persistence
Domain Trust Exploitation
Lateral Movement via Scheduled Tasks
Lateral Movement via WMI
Lateral Movement via WinRM
Lateral Movement via PsExec
Credential Dumping from LSASS
NTDS.dit Extraction
Password Spraying
Kerberos Delegation Abuse
Privilege Escalation via Misconfigured ACLs
Domain Controller Synchronization (DCSync)
SID History Injection
GPO Link and Enforcement

Questions 31–35

31foundation · easy
What is ACL-based persistence in Active Directory?
Select an answer first
32application · medium
During an engagement, you have obtained a low-privileged domain account. Your goal is to gain access to a service account that runs a legacy application. You have identified that the service account has an SPN registered. Which technique would most likely allow you to obtain the service account's password hash for offline cracking?
Select an answer first
33application · medium
You have compromised an account that has the ability to create and link GPOs in the domain. You need to execute a command on all workstations in a specific organizational unit (OU). Which approach is most effective?
Select an answer first
34foundation · easy
What is the primary purpose of a Golden Ticket attack?
Select an answer first
35expert · hard
You have compromised a service account that is configured for constrained delegation to a file server. You need to access the file server as a domain administrator. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.