GPEN Azure AD Integration Practice Question
During a penetration test of a Microsoft Entra ID environment, you discover that an on-premises user account has the ms-DS-ConsistencyGuid attribute set to a value that matches the ImmutableID of a cloud user with higher privileges. What is the most likely security implication of this configuration?
⚠ Common exam trap
The trap here is assuming that the ms-DS-ConsistencyGuid is just a random identifier and not recognizing its role as the source anchor that can be manipulated to link accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It allows the on-premises user to authenticate to the cloud as the privileged user.
The ms-DS-ConsistencyGuid attribute is used as the source anchor when Microsoft Entra Connect is configured to use it. If an attacker can modify this attribute on an on-premises user to match the ImmutableID of a privileged cloud user, the next synchronization will link the on-premises account to the cloud account. The attacker can then authenticate to the cloud as the privileged user, achieving privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It allows the on-premises user to reset the privileged user's password.
Why it's wrong here
While password reset might be possible if the accounts are linked, the primary security implication is authentication as the privileged user, not password reset. The ms-DS-ConsistencyGuid matching enables full account takeover, which includes the ability to reset the password, but that is a secondary effect. The core issue is impersonation.
- ✗
It enables password hash synchronization for the privileged user.
Why it's wrong here
Password hash synchronization is a separate feature and is not directly enabled by matching ms-DS-ConsistencyGuid. The matching attribute links the accounts, but password hash sync would require the feature to be enabled and would synchronize the on-premises password hash, not grant access to the cloud account. This option misrepresents the mechanism.
- ✗
It causes a synchronization error that prevents the user from logging in.
Why it's wrong here
A mismatch or duplicate ms-DS-ConsistencyGuid typically results in a synchronization error, but if it matches another user's ImmutableID, it does not cause an error; instead, it links the accounts. Therefore, this option is incorrect because it describes a different outcome than the actual security implication.
- ✓
It allows the on-premises user to authenticate to the cloud as the privileged user.
Why this is correct
The ms-DS-ConsistencyGuid is used as the source anchor for synchronization. If it matches the ImmutableID of a privileged cloud user, the on-premises user will be linked to that cloud account during synchronization, effectively allowing the on-premises user to take over the cloud identity and authenticate as the privileged user. This is a severe privilege escalation vulnerability.
Visual reference
About these practice questions
Courseiva writes every GPEN question from scratch — 298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.