CPENT Active Directory Attacks Practice Question
An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Request a certificate specifying an arbitrary SAN (e.g., Domain Admin) and use it for PKINIT authentication
ESC1 occurs when a certificate template allows low-privileged users to enroll, permits client authentication, and allows the enrollee to supply an arbitrary Subject Alternative Name (SAN). An attacker can request a certificate with a SAN belonging to a high-privileged user (e.g., Domain Administrator) and use it for authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Request a certificate specifying an arbitrary SAN (e.g., Domain Admin) and use it for PKINIT authentication
Why this is correct
By requesting a certificate with the SAN set to a privileged user account, the attacker can authenticate via PKINIT to obtain a high-privileged TGT.
- ✗
Execute a DCSync attack directly against the Certification Authority web enrollment endpoint
Why it's wrong here
DCSync requires replication rights and cannot be executed via the AD CS web enrollment interface.
- ✗
Force the CA machine account to authenticate to an attacker-controlled SMB share using PetitPotam
Why it's wrong here
PetitPotam (ESC8) exploits web enrollment endpoints for NTLM relay, which is distinct from ESC1 Enrollee Supplies Subject vulnerabilities.
- ✗
Perform a Silver Ticket attack by decrypting the CA database with a captured machine hash
Why it's wrong here
Silver tickets forge service tickets, which is unrelated to AD CS certificate enrollment misconfigurations.
About these practice questions
This CPENT question is part of Courseiva's 274-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.