CPENT Active Directory Attacks Practice Question
During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host
Kerberos delegation vulnerabilities include Unconstrained Delegation (allowing arbitrary service requests), Constrained Delegation with Protocol Transition (S4U2Self/S4U2Proxy abuse), and Resource-Based Constrained Delegation (RBCD).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Standard Kerberos pre-authentication enabled on all standard user accounts with strong passwords
Why it's wrong here
Enforcing pre-authentication and strong passwords is a secure baseline configuration, not a vulnerability.
- ✓
Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host
Why this is correct
Unconstrained delegation forces clients to send their TGTs to the spooler/service, allowing an attacker to capture and reuse them.
- ✓
Resource-Based Constrained Delegation (RBCD) where a compromised machine account has write access to the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of a higher-privileged target
Why this is correct
RBCD allows an attacker who controls a computer object to configure delegation to a target computer, enabling privilege escalation.
- ✓
Constrained Delegation with Protocol Transition (S4U2Self/S4U2Proxy) enabled on a service account without proper restrictions
Why this is correct
Protocol transition allows a service to request a service ticket on behalf of any user, leading to complete domain compromise if abused.
- ✗
Automatic workstation registration limits set to allow zero new domain-joined machines
Why it's wrong here
Restricting machine join quotas is a hardening measure, not a delegation vulnerability.
About these practice questions
One of 274 original CPENT practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.