254 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.
This is exactly what you see during practice — question, options, and a full explanation after you answer.
A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?
KRB5CCNAME is the standard MIT Kerberos environment variable that tells Kerberos-aware tools where to find the credential cache (ccache) file. Exporting it to point at the stolen .ccache lets Impacket tools like psexec.py, wmiexec.py, and smbclient.py authenticate using the ticke…Read full explanation
An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?
ticketer.py from Impacket forges Kerberos tickets offline, including Golden Tickets (using the KRBTGT hash) and Silver Tickets (using a service account hash). It accepts the domain SID, krbtgt NTLM hash, and target username to produce a valid .ccache that can be injected via KRB5…Read full explanation
When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?
SharpHound's LocalAdmin collection method enumerates local administrator rights on computers by querying each machine (via SAM-R, remote registry, or NetSessionEnum depending on privileges) and records which principals have admin access. This data feeds BloodHound's 'AdminTo' edg…Read full explanation
Questions are tagged by exam domain. Practice a specific domain or mix them all.
Answer at your own pace. Explanation and domain tag shown immediately after each answer.
Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.
Full explanations on every question
Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.
Domain score breakdown
After each session see your score by exam domain so you know exactly where to focus study time.
100% free, forever
No subscription, no trial, no email wall. Start a session in under 10 seconds.
Exam-style questions
Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.