PT0-002 Attacks and Exploits Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The service account's password hash

  Why it's wrong here

  The service account's password hash is not a prerequisite for kerberoasting; it is the secondary target obtained by cracking the TGS ticket offline. The attack begins by requesting a service ticket for an SPN, which is encrypted with the service account's password-derived key, and then the attacker extracts that encrypted ticket to brute-force the hash. Possessing the hash already would make the whole operation unnecessary.

• ✓

  A valid domain user account

  Why this is correct

  A valid domain user account is the only prerequisite because Kerberos allows any authenticated domain user to request service tickets for any SPN via the TGS-REQ process. The TGS ticket returned is encrypted with the service account's password hash, so the attacker receives the ciphertext needed for offline cracking. This works with standard user privileges, making the attack low-cost and widely applicable once a single low-level account is compromised.

• ✗

  Administrator privileges on a domain controller

  Why it's wrong here

  Administrator privileges on a domain controller are entirely unnecessary for kerberoasting, as the attack exploits ordinary Kerberos functionality available to all domain users. Requesting TGS tickets is a normal operation that does not require elevated access, and performing the attack from a domain controller would only increase detection risk. The attacker can run the same tooling from a non-admin workstation with a standard user account, so this option is an incorrect overestimation of required privileges.

• ✗

  Local administrator access on a client machine

  Why it's wrong here

  Local administrator access on a client machine is not required because the attack relies solely on the ability to authenticate to the domain and submit a TGS-REQ request, which any authenticated user can do. Local admin rights on a client do not grant additional Kerberos ticket-requesting capabilities or expose service tickets that a normal user cannot already obtain. Tools like GetUserSPNs or Rubeus can execute in the context of a standard domain user from any domain-joined host, making this option both wrong and irrelevant to the attack's success.

Go deeper

Related to this question