hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has obtained the NTLM hash…
A penetration tester has obtained the NTLM hash of a service account during an internal test. The tester wants to gain access to a specific SQL server that uses Kerberos authentication. The tester does not know the plaintext password. Which attack is MOST appropriate to forge a service ticket for the SQL server?
⚠ Common exam trap
Many candidates confuse Silver Ticket attacks (forging service tickets) with Golden Ticket attacks (forging TGTs), but the key distinction is that a Silver Ticket targets a specific service using the service account's hash, while a Golden Ticket grants domain-wide access using the KRBTGT hash.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Silver Ticket attack
A Silver Ticket attack is the most appropriate because it forges a service ticket (TGS) for a specific service, such as the SQL server, using the NTLM hash of the service account. Since the tester has the NTLM hash but not the plaintext password, they can craft a valid Kerberos service ticket without needing to authenticate to the domain controller, directly granting access to the SQL server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Silver Ticket attack
Why this is correct
A Silver Ticket attack forges a Kerberos TGS (Ticket-Granting Service) ticket using the NTLM hash of the target service account. The attacker crafts a TGS for the service's SPN, signs it with the service account's secret, and can impersonate any user to that service without needing the domain's KRBTGT hash. Because the forged TGS is encrypted with the service account's key, the service accepts it as legitimate, granting the attacker persistent, service-specific access.
- ✗
Golden Ticket attack
Why it's wrong here
A Golden Ticket attack requires the KRBTGT account's NTLM hash, not the service account's hash, because the TGT (Ticket-Granting Ticket) is encrypted with the KRBTGT key and contains the PAC (Privilege Attribute Certificate) with domain-wide group memberships. While a Golden Ticket would grant access to all services in the domain, it is overkill for accessing a single service and demands a much higher-privilege compromise (the domain controller's KRBTGT hash) than what the tester currently possesses. Therefore, the correct attack here is a Silver Ticket, not Golden.
- ✗
Pass-the-hash attack
Why it's wrong here
Pass-the-hash (PtH) is an NTLM authentication attack where the attacker supplies the captured NTLM hash instead of a password to complete the NTLM challenge/response exchange. It does not create or forge Kerberos tickets, and it only works over protocols that use NTLM authentication, such as SMB, RDP, or HTTP. Having the service account's NTLM hash would indeed let the tester authenticate via PtH if NTLM is enabled, but the question specifically indicates the need to forge a ticket, which PtH cannot do.
- ✗
SMB relay attack
Why it's wrong here
An SMB relay attack intercepts an SMB authentication session and forwards the captured challenge/response to one or more target hosts, allowing the attacker to authenticate as the victim without knowing the password or hash. This attack does not involve Kerberos ticket generation or service ticket forgery; it relies on relaying network authentication packets. Even though it uses hashes, the mechanism is fundamentally different from forging a TGS ticket, so it is not the correct technique for service-specific ticket forgery.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.