CPENT Practice Question: Privilege Escalation Lateral Movement And Post Exploitation
An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.
DCSync is an attack technique that abuses the Directory Replication Service (DRS) remote protocol to simulate a domain controller and request password data (hashes) for user accounts from another domain controller.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kerberoasting against computer accounts.
Why it's wrong here
Kerberoasting targets service accounts with SPNs, not general domain hashes.
- ✗
Performing an AS-REP Roasting attack on users with Kerberos pre-authentication disabled.
Why it's wrong here
AS-REP Roasting retrieves pre-auth disabled user tickets, yielding limited hashes, not full domain replication.
- ✗
Running Responder on the local subnet to capture NTLMv2 hashes.
Why it's wrong here
Responder captures network authentication traffic, not database hashes directly from Active Directory storage.
- ✓
Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.
Why this is correct
DCSync abuses the DRS protocol to replicate domain object data, including password hashes, without running code on the DC.
Visual reference
About these practice questions
This CPENT question is part of Courseiva's 274-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.