You have administrative credentials for a remote Windows server. You need to execute a command on the server and want to use a tool that is part of the Sysinternals suite. Which technique should you use?

Create a scheduled task on the remote server.

Use PsExec to execute the command remotely.

Use WMI to execute the command remotely.

Use WinRM to execute the command remotely.

Which permission is required to create or modify a GPO?

Write to the GPO container in AD

Local Administrator on the target machine

You have compromised a domain controller and obtained the KRBTGT hash. You want to maintain access to the domain even if the KRBTGT password is changed. Which technique provides the most persistent domain-wide access?

Extract NTDS.dit and crack all password hashes

Modify the AdminSDHolder object to grant yourself rights

Forge a golden ticket using the KRBTGT hash

Create a new domain admin account

During an engagement, you have obtained a low-privileged domain account and want to escalate privileges. You have identified several service accounts with SPNs. Which technique would allow you to obtain password hashes for these accounts without triggering a failed-logon alert?

Dump LSASS memory on the domain controller to extract cached credentials

Perform a password spray against the service accounts using common passwords

Run DCSync against the domain controller to replicate password hashes

Request TGS tickets for the SPNs and crack them offline

GIAC Red Team Professional

Domain 3Objective 2

Leveraging the Domain GRTP Practice Questions (Page 9)

Part of the Active Directory Attacks and Post-Exploitation domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

25concepts

25 Concepts in This Objective

Domain Enumeration
Kerberoasting
AS-REP Roasting
Pass-the-Hash
Pass-the-Ticket
Golden Ticket
Silver Ticket
DCSync
AdminSDHolder and SDProp
Group Policy Object (GPO) Abuse
Skeleton Key
ACL-Based Persistence
Domain Trust Exploitation
Lateral Movement via Scheduled Tasks
Lateral Movement via WMI
Lateral Movement via WinRM
Lateral Movement via PsExec
Credential Dumping from LSASS
NTDS.dit Extraction
Password Spraying
Kerberos Delegation Abuse
Privilege Escalation via Misconfigured ACLs
Domain Controller Synchronization (DCSync)
SID History Injection
GPO Link and Enforcement

Questions 41–45

41application · medium
You have administrative credentials for a remote Windows server. You need to execute a command on the server and want to use a tool that is part of the Sysinternals suite. Which technique should you use?
Select an answer first
42foundation · easy
Which permission is required to create or modify a GPO?
Select an answer first
43expert · hard
You have compromised a domain controller and obtained the KRBTGT hash. You want to maintain access to the domain even if the KRBTGT password is changed. Which technique provides the most persistent domain-wide access?
Select an answer first
44foundation · easy
Which attribute on a user account is required for the account to be vulnerable to Kerberoasting?
Select an answer first
45application · medium
During an engagement, you have obtained a low-privileged domain account and want to escalate privileges. You have identified several service accounts with SPNs. Which technique would allow you to obtain password hashes for these accounts without triggering a failed-logon alert?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRTP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRTP” is a trademark of its owner, used for identification only.