CND Network Attacks And Defense Strategies Practice Question
An attacker compromises an internal Active Directory domain and attempts to leverage Kerberos vulnerabilities and misconfigurations to elevate privileges or establish persistence. Which TWO attacks rely on Kerberos protocol mechanics? (Choose TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kerberoasting by requesting Service Tickets (TGS) for SPN-associated service accounts and cracking them offline.
Kerberoasting targets service accounts with SPNs to crack TGS tickets offline, while AS-REP Roasting targets user accounts that do not require Kerberos pre-authentication to obtain AS-REP tickets for offline cracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-Site Scripting (XSS) via injected JavaScript payloads executed in victim browsers.
Why it's wrong here
XSS is a browser-based application vulnerability, not a Kerberos attack.
- ✓
Kerberoasting by requesting Service Tickets (TGS) for SPN-associated service accounts and cracking them offline.
Why this is correct
Kerberoasting extracts TGS tickets for accounts with SPNs for offline password cracking.
- ✗
SQL Injection (SQLi) by appending malicious query parameters to authentication web forms.
Why it's wrong here
SQLi is a web application vulnerability, not a Kerberos protocol attack.
- ✗
ARP Cache Poisoning to intercept local subnet Layer 2 Ethernet frames.
Why it's wrong here
ARP poisoning is a Layer 2 Ethernet attack, unrelated to Kerberos authentication.
- ✓
AS-REP Roasting by requesting Ticket Granting Service (TGS) tickets for accounts with 'Do not require Kerberos preauthentication' enabled.
Why this is correct
AS-REP Roasting targets accounts with pre-authentication disabled to obtain crackable ticket data.
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.