Courseiva

CPENT · topic practice

Active Directory Attacks practice questions

This domain covers attacking and defending Microsoft Active Directory: reconnaissance with BloodHound, Kerberos abuse (AS-REP and Kerberoasting), ACL and group-membership abuse, delegation, and AD CS certificate template exploitation (ESC1–ESC8). CPENT tests these through scenario-based tasks where you enumerate, exploit, and pivot to Domain Admin inside a live lab range.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Active Directory Attacks
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Active Directory Attacks

Enumerate the domain, collect BloodHound data, identify abusable ACLs, Kerberos settings, and AD CS templates, then exploit them to escalate to Domain Admin. The single most important thing: verify the exact permission or misconfiguration before running an attack, since each edge and ESC maps to a specific technique.

BloodHound/SharpHound collection and reading edges like GenericAll, WriteDacl, and AddMember

AS-REP roasting of accounts with 'Do not require Kerberos preauthentication' via GetNPUsers

Kerberoasting service accounts with GetUserSPNs and cracking SPN ticket hashes offline

AD CS ESC1-ESC8 abuse using Certipy or Certify against misconfigured certificate templates

Watch out for

Common Active Directory Attacks exam traps

  • ▸Confusing WriteDacl with GenericAll: WriteDacl only lets you rewrite permissions, not directly add members or reset passwords.
  • ▸Forgetting that AS-REP roasting needs preauth disabled, while Kerberoasting needs an SPN and any valid domain credentials.
  • ▸Treating BloodHound edges as guaranteed exploits instead of checking the actual ACL or template before attempting abuse.

Practice set

Active Directory Attacks questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice
Read the full Active Directory Attacks explanation →

A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?

Question 2easymultiple choice
Read the full Active Directory Attacks explanation →

A penetration tester is attempting to perform Kerberoasting using Impacket. Which specific service principal name (SPN) format must be requested against the target domain controller to successfully extract TGS-AEAD tickets that can be cracked offline?

Question 3hardmultiple choice
Read the full Active Directory Attacks explanation →

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Question 4mediummulti select
Read the full Active Directory Attacks explanation →

Which TWO of the following Impacket tools can be utilized to perform credential dumping or secret extraction from Active Directory or target systems when valid administrator credentials are known?

Question 5mediummulti select
Read the full Active Directory Attacks explanation →

Which TWO methods can an operator use to mitigate or prevent detection while performing Kerberoasting during an internal penetration test?

Question 6hardmulti select
Read the full Active Directory Attacks explanation →

In the context of AD CS abuse, which THREE vulnerabilities or template settings are categorized under certificate template misconfigurations that allow privilege escalation?

Question 7hardmulti select
Read the full Active Directory Attacks explanation →

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

Question 8mediummulti select
Read the full Active Directory Attacks explanation →

Which TWO commands or tools are standard for performing AS-REP Roasting against an Active Directory domain from an external or internal position?

Question 9mediummulti select
Read the full Active Directory Attacks explanation →

Which TWO tools are commonly used for analyzing BloodHound database outputs or querying attack paths during an Active Directory penetration test?

Question 10hardmulti select
Read the full Active Directory Attacks explanation →

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Question 11easymultiple choice
Read the full Active Directory Attacks explanation →

During an internal penetration test, an operator compromises a low-privileged domain user account and wishes to perform a Kerberoasting attack to harvest service principal name (SPN) tickets. Which standard utility included with Windows PowerShell or Sysinternals can be used to request these tickets without administrative privileges?

Question 12hardmulti select
Read the full Active Directory Attacks explanation →

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

Question 13mediummulti select
Study the full ACL explanation →

Which TWO methods can an operator use to verify whether an account has successfully been granted DCSync privileges after modifying access control lists (ACLs)?

Question 14mediummultiple choice
Read the full Active Directory Attacks explanation →

A penetration tester has compromised an account that possesses the 'GenericAll' permission over a Group Policy Object (GPO) linked to the domain. How can this permission be leveraged to achieve remote code execution across systems affected by the GPO?

Question 15hardmultiple choice
Read the full Active Directory Attacks explanation →

During an Active Directory assessment, an operator discovers that the KRBTGT account password has not been rotated in over ten years. They decide to craft a Golden Ticket to maintain persistent domain-wide access. Which critical piece of information, in addition to the KRBTGT NTLM hash and domain SID, is strictly required to generate a fully valid Golden Ticket that includes group membership and privilege attributes?

Question 16mediummulti select
Read the full Active Directory Attacks explanation →

An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)

Question 17mediummultiple choice
Read the full Active Directory Attacks explanation →

A penetration tester has obtained the NT hash of a domain user account through credential dumping. The tester wants to authenticate to a remote server using this hash without knowing the plaintext password. Which Impacket tool should the tester use?

Question 18mediummultiple choice
Read the full Active Directory Attacks explanation →

During an internal penetration test, you have obtained the NTLM hash of a domain user account that has local administrative rights on a workstation. You want to move laterally to another workstation in the same domain using only this hash, without knowing the plaintext password. Which technique and tool combination would allow you to execute a remote command on the target workstation?

Question 19easymultiple choice
Read the full Active Directory Attacks explanation →

A penetration tester has gained access to a workstation and wants to enumerate Active Directory domain trusts to identify potential lateral movement paths to other domains. Which command-line tool can be used to list domain trusts from the compromised workstation?

Question 20mediummulti select
Read the full Active Directory Attacks explanation →

An operator is performing an Active Directory penetration test and wants to enumerate all domain-joined computers to identify potential targets for lateral movement. Which TWO of the following tools or commands can be used to perform this enumeration from a domain-joined Windows host with standard domain user credentials? (Choose two.)

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Active Directory Attacks sessions

Start a Active Directory Attacks only practice session

Every question in these sessions is drawn from the Active Directory Attacks domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Active Directory Attacks questions →Mixed CPENT session

Related practice questions

Related CPENT topic practice pages

Move into related areas when this topic feels solid.

Network And Perimeter Exploitation practice questions

Practise CPENT questions linked to Network And Perimeter Exploitation.

Active Directory Attacks practice questions

Practise CPENT questions linked to Active Directory Attacks.

Iot And OT Exploitation practice questions

Targeted CPENT practice covering Iot And OT Exploitation.

Cloud And Hybrid Infrastructure Security practice questions

Targeted CPENT practice covering Cloud And Hybrid Infrastructure Security.

Privilege Escalation Lateral Movement And Post Exploitation practice questions

Privilege Escalation Lateral Movement And Post Exploitation practice questions for CPENT.

CPENT fundamentals practice questions

Work through CPENT questions on CPENT fundamentals.

CPENT scenario practice questions

Sharpen your CPENT knowledge of CPENT scenario.

CPENT troubleshooting practice questions

Sharpen your CPENT knowledge of CPENT troubleshooting.

Frequently asked questions

What does the CPENT exam test about Active Directory Attacks?
Enumerate the domain, collect BloodHound data, identify abusable ACLs, Kerberos settings, and AD CS templates, then exploit them to escalate to Domain Admin. The single most important thing: verify the exact permission or misconfiguration before running an attack, since each edge and ESC maps to a specific technique.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Active Directory Attacks questions in a focused session?
Yes — the session launcher on this page draws every question from the Active Directory Attacks domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CPENT topics?
Use the topic links above to move to related areas, or go back to the CPENT question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the CPENT exam covers. They are not copied from any real exam or dump site.