mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester with a low-privileged domain…
A penetration tester with a low-privileged domain user account performs a Kerberoasting attack. What is the primary goal of this attack?
⚠ Common exam trap
CompTIA often tests the misconception that Kerberoasting directly yields a domain admin ticket or a TGT, when in fact it only provides a service ticket that must be cracked offline to recover the plaintext password of the service account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Obtain the plaintext password of a user account with a Service Principal Name (SPN).
Kerberoasting targets service accounts that have a Service Principal Name (SPN) registered in Active Directory. The attacker requests a Kerberos service ticket (TGS) for the SPN, which is encrypted with the service account's NTLM hash. The attacker then cracks this hash offline to recover the plaintext password, enabling lateral movement or privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Obtain the NTLM hash of the krbtgt account.
Why it's wrong here
Kerberoasting specifically targets service accounts (accounts with SPNs) by requesting TGS tickets encrypted with the service account's password hash, not the krbtgt account. The krbtgt hash is only obtainable via domain compromise techniques like DCSync or NTDS.dit extraction, and it is used for Golden Ticket attacks, not Kerberoasting. These are entirely separate attack paths with different prerequisites and goals.
- ✗
Obtain a list of all domain users.
Why it's wrong here
Kerberoasting does not enumerate the full user directory; it sends TGS requests only for known SPN-linked accounts and receives only the corresponding service tickets. The attack requires a pre-existing list of SPNs, typically gathered via LDAP queries, but never outputs a user list. Comprehensive user enumeration requires dedicated directory queries or tools like PowerView, making this option incorrect.
- ✗
Obtain a Kerberos ticket that can be used to impersonate a domain admin.
Why it's wrong here
Kerberoasting yields TGS tickets that are encrypted with the target service account's password-derived key, not a privileged account's hash, and these tickets can only access that specific service. They cannot be used to impersonate a domain admin across the domain because impersonation via Silver or Golden tickets requires the service account's or krbtgt account's hash, which this technique does not obtain. The response was not accepting.
- ✓
Obtain the plaintext password of a user account with a Service Principal Name (SPN).
Why this is correct
Kerberoasting exploits the fact that Kerberos service tickets are encrypted with a key derived from the SPN-linked account's password (often RC4_HMAC or AES). By requesting a TGS ticket for such an account, the attacker obtains an offline-crackable ciphertext that, when cracked, reveals the plaintext password. If the service account is privileged, this can lead to full domain compromise, which is why it is a critical privilege escalation vector.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
Key term
Kerberoasting
Kerberoasting is an attack where a hacker steals service account password hashes from Active Directory to crack them offline and gain unauthorized access.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.