GCIH Attacking Passwords Practice Question
When analyzing a compromised system, you find evidence of 'Kerberoasting'. What is the primary objective of this attack, and what specific artifact is the attacker attempting to acquire?
⚠ Common exam trap
Candidates often think the goal is to gain immediate entry to the Domain Controller, rather than understanding that the TGS is used for offline password cracking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Acquiring the TGS; goal is to crack service account passwords
The primary objective of Kerberoasting is to obtain service tickets for service accounts with Service Principal Names (SPNs). The attacker requests a TGS (Ticket Granting Service) ticket for a service account, which is encrypted using the account's password hash. By extracting this ticket, the attacker can move the data offline and attempt to crack the password hash without further interaction with the Domain Controller, avoiding detection by account lockout policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Acquiring the TGT; goal is to forge Golden Tickets
Why it's wrong here
Acquiring the TGT is associated with the 'Golden Ticket' attack, which requires the KRBTGT account hash. Kerberoasting targets service accounts to obtain TGS tickets, which are encrypted with the service account's password hash, not the domain-wide KRBTGT hash.
- ✓
Acquiring the TGS; goal is to crack service account passwords
Why this is correct
Kerberoasting involves requesting TGS tickets for SPN-enabled accounts. These tickets are encrypted with the account's password hash. Offline cracking of these tickets reveals the plaintext password, allowing the attacker to escalate privileges if the service account has excessive permissions on the network.
- ✗
Acquiring the NTLM hash; goal is Pass-the-Hash
Why it's wrong here
Kerberoasting results in an encrypted Kerberos TGS blob, not a raw NTLM hash. While the final goal is gaining access, the technique specifically relies on Kerberos ticket encryption, not NTLM protocol interception or pass-the-hash methodologies.
- ✗
Acquiring the PAC; goal is privilege escalation
Why it's wrong here
The Privilege Attribute Certificate (PAC) is part of a ticket, but Kerberoasting does not aim to acquire the PAC specifically. The objective is to crack the service account's password by brute-forcing the encrypted ticket payload provided by the Key Distribution Center.
About these practice questions
This GCIH question is part of Courseiva's 322-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.