PT0-002 Vulnerability Discovery and Analysis Practice Question
A tester wants to perform a Kerberoasting attack against an Active Directory environment. Which Impacket tool would be most appropriate?
⚠ Common exam trap
The exam often tests the distinction between tools that extract hashes (secretsdump) versus tools that request Kerberos tickets (GetUserSPNs), leading candidates to confuse hash dumping with Kerberoasting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GetUserSPNs
GetUserSPNs is the correct Impacket tool for Kerberoasting because it queries Active Directory for Service Principal Names (SPNs) associated with user accounts, then requests TGS tickets for those services. These tickets can be cracked offline to recover the service account's password hash, enabling privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
wmiexec
Why it's wrong here
wmiexec executes commands over WMI/DCOM and requests no Kerberos service ticket, so it cannot harvest crackable TGS-encrypted hashes. It tempts because it is a valid Impacket lateral-movement and remote-execution tool, which would suit that scenario; Kerberoasting requires GetUserSPNs.py to request service tickets.
- ✗
psexec
Why it's wrong here
PsExec provides remote command execution over SMB using valid credentials, producing no Kerberos service ticket to crack. It fits lateral movement or obtaining a shell on a target host once credentials exist, whereas Kerberoasting needs a tool that requests TGS tickets for accounts with service principal names.
- ✗
secretsdump
Why it's wrong here
Secretsdump extracts credential hashes and secrets from SAM, LSA and NTDS, which yields no service ticket for offline cracking. It is the right tool for dumping domain credential material after obtaining sufficient privileges, not for requesting RC4 TGS tickets tied to accounts with registered SPNs.
- ✓
GetUserSPNs
Why this is correct
GetUserSPNs queries Active Directory for accounts with Service Principal Names, then requests Kerberos service tickets encrypted with those accounts' password hashes. This directly satisfies the Kerberoasting requirement: extracting crackable TGS tickets offline without triggering authentication failures.
Go deeper
Related to this question
Learn chapter
Privilege Escalation on Linux
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
Key term
Kerberoasting
Kerberoasting is an attack where a hacker steals service account password hashes from Active Directory to crack them offline and gain unauthorized access.
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.