mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has compromised a Windows…
A penetration tester has compromised a Windows workstation and obtained a low-privileged domain user account. The tester discovers that this user belongs to a group that has the 'GenericWrite' privilege over a computer object in Active Directory. Which attack is most directly enabled by this misconfiguration?
⚠ Common exam trap
Test-takers frequently confuse the GenericWrite privilege with the ability to perform Kerberoasting or AS-REP Roasting, but those attacks require different preconditions (SPN or no pre-authentication) and do not directly exploit write access to computer object attributes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shadow Credentials
The 'GenericWrite' privilege over a computer object allows the attacker to write to the msDS-KeyCredentialLink attribute of that object. By adding a rogue key credential, the attacker can trigger the Key Distribution Center (KDC) to accept a certificate-based authentication, enabling the Shadow Credentials attack to obtain a TGT for the computer account and escalate privileges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kerberoasting
Why it's wrong here
Kerberoasting requires an account that has a Service Principal Name (SPN) so a TGS ticket encrypted with the account's password hash can be requested and cracked offline. A computer account does automatically possess a default SPN (e.g., host/computername), but its password is a long, random 120-character value that is computationally infeasible to crack. Furthermore, the GenericWrite permission over the computer object does not grant the ability to request service tickets or to assign new SPNs; it merely allows attribute modification, not the control of authentication flows needed for this attack.
- ✓
Shadow Credentials
Why this is correct
GenericWrite over a computer object allows the tester to write to the msDS-KeyCredentialLink attribute, which stores public key credentials used for PKINIT authentication. By adding a rogue certificate mapped to a private key they control, the tester can then request a TGT for that computer account, effectively taking over the identity. This Shadow Credentials attack is stealthy because it does not require resetting the password, works even when pre-authentication is enabled, and persists until the key credential is removed.
- ✗
AS-REP Roasting
Why it's wrong here
AS-REP roasting exploits accounts that have the 'Do not require Kerberos pre-authentication' flag, allowing an attacker to send an AS-REQ without proof of identity and receive a ticket encrypted with the account's password hash. GenericWrite over a computer object does not grant any ability to toggle this UAC flag or affect Kerberos pre-authentication settings. Even if it could, the flag is rarely set on computer accounts, and the attack is fundamentally about missing pre-authentication, not about key credential writes.
- ✗
DCSync Attack
Why it's wrong here
DCSync attack requires the extended rights Replicating Directory Changes and Replicating Directory Changes All, which are typically held by domain controllers and a few privileged accounts. GenericWrite on a single computer object gives write access only to that object's attributes, not domain-wide replication rights. Without replication privileges, the tester cannot invoke the Directory Replication Service to retrieve NTLM password hashes for other accounts, making DCSync technically impossible from this starting point.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.