20+ practice questions focused on Active Directory Attacks — one of the most tested topics on the EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Active Directory Attacks PracticeA penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?
Explanation: AS-REP Roasting exploits accounts with the DONT_REQUIRE_PREAUTH flag set, which allows an attacker to request an AS-REP (Authentication Service Response) from the Key Distribution Center (KDC) without providing valid credentials. The KDC returns a response encrypted with the user's password hash, which can be captured and cracked offline. This attack is possible because pre-authentication is disabled, meaning the KDC does not verify the user's identity before issuing a ticket-granting ticket (TGT).
A penetration tester is attempting to perform Kerberoasting using Impacket. Which specific service principal name (SPN) format must be requested against the target domain controller to successfully extract TGS-AEAD tickets that can be cracked offline?
Explanation: Kerberoasting targets accounts with a registered Service Principal Name (SPN). Requesting a TGS for an SPN like MSSQLSvc/sqlserver01.corp.local:1433 causes the KDC to encrypt the ticket with the service account's password hash, which can be extracted and cracked offline. The SPN must correspond to a user or service account whose password the attacker wants to crack.
An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?
Explanation: When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.
Which TWO of the following Impacket tools can be utilized to perform credential dumping or secret extraction from Active Directory or target systems when valid administrator credentials are known?
Explanation: goldenPac.py [CORRECT] is an Impacket tool that combines MS14-068 exploitation with PsExec-style execution to obtain a Kerberos golden ticket and then dump credentials from a domain controller, making it valid for secret extraction when admin credentials are known. secretsdump.py [CORRECT] is Impacket's dedicated tool for remotely extracting SAM, LSA secrets, cached credentials, and NTDS.dit hashes via SMB, WMI, VSS, or DRS-RPC using supplied administrator credentials. ntlmrelayx.py is used for NTLM relay attacks, not credential dumping, and GetUserSPNs.py performs Kerberoasting to request service tickets for offline cracking rather than extracting stored secrets. lookupsid.py enumerates SIDs over MS-RPC for user/group discovery and does not dump credentials or secrets.
Which TWO methods can an operator use to mitigate or prevent detection while performing Kerberoasting during an internal penetration test?
Explanation: Option A is correct because requesting service tickets with AES encryption types (e.g., AES256-CTS-HMAC-SHA1-96) instead of RC4-HMAC avoids generating the weak, easily cracked RC4-encrypted TGS tickets that Kerberoasting typically relies on, and it also reduces the distinctive RC4 ticket-request patterns that defenders and EDR/NDR tooling flag. Option D is correct because requesting TGS tickets for a small set of specific target SPNs, rather than enumerating and bulk-requesting tickets for every SPN in the domain, minimizes the volume and burst of 4769 events that detection logic (e.g., many TGS requests from one account in a short window) keys on. Option B is wrong because disabling Kerberos pre-authentication on service accounts is an AS-REP Roasting condition, not a Kerberoasting mitigation, and it actually increases exposure rather than preventing detection. Option C is wrong because exporting NTDS.dit over SMB is a domain-database theft technique (e.g., via Volume Shadow Copy or DRSUAPI), unrelated to Kerberoasting and highly detectable in its own right. Option E is wrong because offline cracking of retrieved TGS tickets is the post-exploitation cracking step of Kerberoasting itself; it does not mitigate or prevent detection of the ticket-request activity on the network.
+15 more Active Directory Attacks questions available
Practice all Active Directory Attacks questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Active Directory Attacks. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Active Directory Attacks questions on the CPENT frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Active Directory Attacks is tested as part of the EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) blueprint. Practicing with targeted Active Directory Attacks questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CPENT practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Active Directory Attacks is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Active Directory Attacks practice session with instant scoring and detailed explanations.
Start Active Directory Attacks Practice →