CPENT Active Directory Attacks Practice Test 4 — 15 Questions

Question 1

Which TWO Active Directory mechanisms or configurations are commonly targeted during lateral movement to bypass traditional perimeter security and leverage built-in domain trust relationships?

Accepted Answer

Kerberos Constrained and Unconstrained Delegation. Option B is correct because Kerberos delegation — both unconstrained (where a service can impersonate users to any service) and constrained (where it is limited to specified services) — is a classic lateral-movement and privilege-escalation target: an attacker who compromises a delegation-enabled service account can obtain forwardable TGTs or service tickets and impersonate high-privileged users across the domain without touching perimeter defenses. Option E is correct because external and forest trust relationships extend authentication across domain/forest boundaries, and when SID filtering is disabled or trusts are misconfigured, attackers can abuse SIDHistory injection or cross-trust Kerberos referrals to move laterally into trusted domains while appearing as legitimate internal authentication traffic. Option A (LAPS) is not a lateral-movement bypass mechanism; it is a defensive control that randomizes local administrator passwords to prevent pass-the-hash reuse. Option C (NTLMv2 hash signing enforcement) is a hardening measure that restricts NTLM relay/credential reuse rather than a trust-abuse vector. Option D (account lockout threshold policies) is a defensive policy that limits brute-force attempts and does not itself enable lateral movement or trust abuse.

Answer

Local Administrator Password Solution (LAPS)

Answer

NTLMv2 hash signing enforcement

Answer

Account lockout threshold policies

Question 2

Which THREE tactics or actions are effective in defending against or detecting Golden Ticket attacks in an enterprise Active Directory environment?

Accepted Answer

Enforcing Tiered Administration models to protect domain controller access. Option B is correct because enforcing Tiered Administration models restricts who can log on to and administer Tier 0 assets such as domain controllers, limiting the credential exposure that enables an attacker to obtain the KRBTGT hash needed to forge a Golden Ticket. Option D is correct because Golden Tickets are forged TGTs, and their abuse surfaces in Kerberos service ticket activity; monitoring TGS requests (Event ID 4769) for anomalous ticket lifetimes, encryption types, or account patterns helps detect forged tickets that bypass normal TGT issuance. Option E is correct because the KRBTGT account's password hash signs all TGTs, so a double-rotation (resetting the password twice, with replication in between) invalidates existing Golden Tickets and prevents their continued use. Option A is wrong because enabling unconstrained delegation on workstations expands attack surface and lets compromised hosts impersonate users to services, which aids attackers rather than defending against Golden Tickets. Option C is wrong because disabling LDAP channel binding weakens protection against relay and credential-theft attacks on domain controllers, making the environment less secure, not more.

Answer

Enabling unconstrained delegation on all workstation computer objects

Answer

Disabling LDAP channel binding on all domain controllers

Question 3

Which TWO native Windows tools or Sysinternals utilities can be used by an operator during post-exploitation to dump credentials from the LSASS process memory?

Accepted Answer

Sysinternals ProcDump.exe. Sysinternals ProcDump.exe (option B) is correct because it can create a memory dump of a running process, including lsass.exe, using syntax such as procdump -ma lsass.exe lsass.dmp, which can then be parsed offline with Mimikatz to extract credentials. Option D is also correct because rundll32.exe can invoke the native comsvcs.dll MiniDump export, e.g. rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:\lsass.dmp full, producing an LSASS memory dump without external tooling. Option A (tasklist.exe /v) only lists running processes with verbose details and cannot dump memory. Option C (gpresult.exe /h report.html) generates a Group Policy Resultant Set of Policy HTML report and has no credential-dumping capability. Option E (netstat.exe -ano) only displays network connections with owning PIDs and cannot read LSASS memory.

Answer

tasklist.exe /v

Answer

gpresult.exe /h report.html

Answer

netstat.exe -ano

Question 4

Which THREE methods or attack primitives can be used to achieve domain escalation when an attacker has compromised an account with 'GenericAll' permissions over a Group Policy Object (GPO)?

Accepted Answer

Adding a startup script or service configuration within the GPO file share path in SYSVOL. With GenericAll over a GPO, an attacker can edit the GPO's contents and have them applied to all linked OUs, computers, or users. Option A is correct because writing a startup script or service configuration into the GPO's SYSVOL path (\\SYSVOL\\Policies\{GUID}\Machine\Scripts\Startup or the GptTmpl.inf service section) causes the script/service to execute as SYSTEM on every affected machine at boot. Option B is correct because GPO security settings (e.g., Restricted Groups or Group Policy Preferences local users/groups) can add a controlled account to the local Administrators group or create local users across all machines in the linked OU, yielding broad local admin and lateral movement. Option D is correct because Group Policy Preferences support Immediate Scheduled Tasks (ScheduledTasks.xml in SYSVOL), which execute on the next policy refresh as SYSTEM, giving code execution on target hosts. Option C is wrong because the KRBTGT password is stored in AD (NTDS.dit) and cannot be changed through GPO settings; GPOs do not manage domain account credentials. Option E is wrong because NTDS.dit is not writable via unauthenticated LDAP, and LDAP writes require authenticated, authorized access to AD objects, not merely GPO GenericAll.

Answer

Modifying the KRBTGT account password directly through Group Policy settings

Answer

Directly modifying the NTDS.dit database via unauthenticated LDAP write operations

Question 5

Which TWO configuration checks should a penetration tester perform when auditing an Active Directory domain for potential NTLM Relay vulnerabilities?

Accepted Answer

Verify if LDAP signing is disabled or set to 'Not Required' on domain controllers.. Option A is correct because when LDAP signing is disabled or set to 'Not Required' on domain controllers, an attacker who has coerced or relayed NTLM authentication can relay it to LDAP/LDAPS and perform operations such as adding a computer or modifying ACLs, which is a classic NTLM relay path. Option B is correct because SMB signing enforcement determines whether relayed NTLM authentication can be used against SMB services; if signing is not required on member workstations and servers, captured NTLM authentication can be relayed to those hosts to execute commands or access resources. Option C is not relevant because the domain functional level does not directly determine whether NTLM relay is possible; modern functional levels can still be vulnerable if signing and channel binding are not enforced. Option D is incorrect because disabling Kerberos pre-authentication enables AS-REP roasting, not NTLM relay, and it is not a standard NTLM relay audit check. Option E is incorrect because the number of SPNs on machine accounts relates to Kerberoasting and service account exposure, not directly to NTLM relay vulnerability.

Answer

Check if the domain functional level is set to Windows 2000 native.

Answer

Verify that all user accounts have Kerberos pre-authentication disabled.

Answer

Enumerate the total number of Service Principal Names registered to machine accounts.

Question 6

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

Accepted Answer

Disable HTTP-based web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA) enabled.. Option A is correct because ESC8 abuses the HTTP-based web enrollment endpoints (certsrv) via NTLM relay, so disabling HTTP enrollment or enforcing HTTPS with Extended Protection for Authentication (EPA) and disabling NTLM on those endpoints blocks that relay vector. Option B is correct because continuous auditing of AD CS templates, CAs, and ACLs with tools like Certipy or BloodHound (e.g., Certipy's 'find' and 'template' checks) surfaces misconfigurations such as ESC1-ESC8 before attackers exploit them. Option E is correct because removing the ENROLLEE_SUPPLIES_SUBJECT flag prevents low-privileged enrollees from specifying an arbitrary subject/SAN (e.g., a domain admin UPN), which is the core of ESC1 template abuse. Option C is wrong because disabling Kerberos pre-authentication on domain controller computer accounts would weaken authentication and enable AS-REP roasting, not secure AD CS. Option D is wrong because enforcing unconstrained delegation on CA servers increases exposure to credential theft and relay/impersonation attacks rather than mitigating certificate abuse.

Answer

Disable Kerberos pre-authentication across all domain controller computer accounts.

Answer

Enforce unconstrained delegation on all certificate authority servers.

Question 7

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

Accepted Answer

psexec.py from the Impacket toolkit. Pass-the-Hash relies on injecting or using the NTLM hash directly in place of the user's password during authentication. Impacket's psexec.py (or crackmapexec / netexec) natively supports NTLM hash authentication.

Answer

Windows Remote Desktop Connection (mstsc.exe)

Answer

Standard Windows net use command

Answer

WinRM standard client via browser

Question 8

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

Accepted Answer

Mimikatz: kerberos::ptt ticket.kirbi. Pass-the-Ticket involves injecting exported ticket files (such as .kirbi or .ccache format) into memory. Mimikatz uses the 'kerberos::ptt' command to inject a ticket into the current Windows logon session.

Answer

Rubeus: golden /ticket:ticket.kirbi

Answer

PowerView: Invoke-TicketInjection -Path ticket.kirbi

Answer

Impacket: ticketer.py -nthash ...

Question 9

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

Accepted Answer

SharpHound. SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.

Answer

BloodHound-Collector-GUI

Answer

AD-Collector-Pro

Answer

Responder

Question 10

An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?

Accepted Answer

Request a certificate specifying an arbitrary SAN (e.g., Domain Admin) and use it for PKINIT authentication. ESC1 is the AD CS misconfiguration where a template allows the enrollee to supply the subject (including SAN) and permits client authentication, while low-privileged users can enroll. An attacker requests a certificate with an arbitrary SAN such as the Domain Admin's UPN, then uses it for PKINIT (Kerberos certificate logon) to obtain a TGT as that user — effectively impersonating Domain Admin without knowing their password.

Answer

Execute a DCSync attack directly against the Certification Authority web enrollment endpoint

Answer

Force the CA machine account to authenticate to an attacker-controlled SMB share using PetitPotam

Answer

Perform a Silver Ticket attack by decrypting the CA database with a captured machine hash

Question 11

During a Red Team assessment against an enterprise network, an operator wants to execute a Silver Ticket attack against a specific service (e.g., CIFS) on a target server. What is a key operational advantage of a Silver Ticket compared to a Golden Ticket?

Accepted Answer

It does not require interaction with the Domain Controller to generate and does not alert the KDC for a TGT request. A Silver Ticket is forged for a specific service using the NTLM hash of that specific service account (or computer account), meaning it does not require interaction with the Domain Controller's KDC for creation, and it does not generate a TGT request that might alert domain-level monitoring.

Answer

It can only be detected by physically inspecting the NTDS.dit file on the Domain Controller

Answer

It grants full Domain Administrator privileges across all domain controllers

Answer

It automatically updates the KRBTGT password to maintain persistence

Question 12

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

Accepted Answer

Rubeus (rubeus.exe asreproast). Option C is correct because Rubeus is a dedicated Kerberos attack toolkit, and its `asreproast` command specifically enumerates and extracts AS-REP hashes from accounts whose UserAccountControl flag does not have Kerberos preauthentication required (UF_DONT_REQUIRE_PREAUTH, 0x400000), which an unprivileged domain user can perform. Option E is correct because PowerView's `Get-DomainUser -PreauthNotRequired` queries Active Directory via LDAP for user objects with the DONT_REQUIRE_PREAUTH flag set, directly identifying AS-REP roasting candidates without elevated privileges. Option A is wrong because cleanmgr.exe is a disk cleanup utility with no AD enumeration capability. Option B is wrong because Mimikatz's `lsadump::dcsync` requires DCSync rights (typically Domain Admin or Replicating Directory Changes permissions), so it is not usable by an unprivileged domain user. Option D is wrong because secpol.msc edits local security policy on a single host and does not enumerate domain accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 13

An advanced adversary has gained Domain Administrator privileges and wants to establish stealthy, long-term persistence in Active Directory without relying solely on traditional user accounts or standard scheduled tasks. Which THREE advanced persistence mechanisms can be deployed in an Active Directory environment? (Choose THREE)

Accepted Answer

AD CS Certificate Mapping (mapping a rogue certificate to a domain account for persistent PKINIT authentication). Option A is correct because AD CS certificate mapping lets an attacker who controls a rogue CA or template map a certificate to a domain account, enabling persistent PKINIT authentication that survives password resets and is hard to detect. Option B is correct because SID History Injection appends a high-privileged SID (e.g., Domain Admins) to a standard user's sIDHistory attribute, granting that account privileged access that persists across sessions and is often overlooked by standard account reviews. Option C is correct because DCShadow registers a rogue Domain Controller via replication (using DRSUAPI) to inject objects and attribute changes directly into the AD database, bypassing normal change-tracking and many standard event logs. Option D is not a persistence mechanism—defrag.exe is a routine disk maintenance utility with no security or persistence impact on AD. Option E is also unrelated to persistence; modifying TCP/IP registry keys to disable DHCP client notifications is a network configuration tweak, not an Active Directory persistence technique.

Answer

Running the standard Windows Disk Defragmenter (defrag.exe) on the Domain Controller C: drive

Answer

Modifying the Windows TCP/IP stack registry keys to disable DHCP client notifications

Question 14

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Accepted Answer

Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host. Option B is correct because Unconstrained Delegation (TrustedForDelegation) causes the host to cache the TGT of every authenticating user in LSASS memory; an attacker who compromises that host can extract those TGTs (e.g., via Mimikatz) and impersonate privileged users across the domain. Option C is correct because RBCD abuse occurs when an attacker controls a principal with write access to a target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute, letting them configure the target to trust their controlled account and then obtain service tickets via S4U2Self/S4U2Proxy to impersonate any user to that target. Option D is correct because Constrained Delegation with Protocol Transition allows a service to obtain a forwardable ticket for a user without that user's credentials (S4U2Self) and then use S4U2Proxy to access downstream services, so a compromised service account can pivot to any resource listed in msDS-AllowedToDelegateTo. Option A is not a vulnerability—Kerberos pre-authentication with strong passwords is a hardening best practice that resists AS-REP roasting. Option E is unrelated to delegation; it concerns machine account quota (ms-DS-MachineAccountQuota) and does not by itself constitute a Kerberos delegation attack vector.

Answer

Standard Kerberos pre-authentication enabled on all standard user accounts with strong passwords

Answer

Automatic workstation registration limits set to allow zero new domain-joined machines

Question 15

An operator has compromised a domain user account and wants to perform a Kerberoasting attack to extract service account hashes. The operator uses Rubeus with the kerberoast command. Which encryption type should the operator request to maximize the chance of cracking the extracted tickets?

Accepted Answer

RC4 (etype 23). The correct answer is RC4 (etype 23) because it is the weakest encryption type for Kerberos tickets and is easier to crack. By requesting RC4 tickets, the operator increases the chances of successfully cracking the service account hash offline, especially if the password is weak. This is a common tactic in Kerberoasting attacks.

Answer

DES (etype 1)

Answer

AES256 (etype 18)

Answer

AES128 (etype 17)