GPEN Azure AD Integration Practice Question
During an internal penetration test, an attacker compromises a standard user account in a hybrid Microsoft Entra ID environment. The organization synchronizes on-premises identities using Microsoft Entra Connect with Pass-Through Authentication enabled. Which technique allows the attacker to compromise additional cloud and on-premises identities without triggering standard cloud MFA prompts?
⚠ Common exam trap
Candidates often assume cloud-based conditional access policies automatically intercept all on-premises authentication flows, forgetting that legacy protocols or poorly configured authentication agents can bypass modern multi-factor verification entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Abusing compromised credentials against legacy authentication endpoints or poorly secured client applications that bypass modern conditional access and MFA controls.
Pass-Through Authentication validates user credentials directly against the on-premises Active Directory by passing the raw credentials through the authentication agent. When an attacker compromises an active session or abuses legacy authentication protocols that bypass conditional access and multi-factor authentication requirements, they can pivot between cloud and on-premises domains seamlessly without triggering supplementary challenges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Injecting malicious golden tickets into Microsoft Entra Connect sync engine database tables to forge valid cloud security tokens.
Why it's wrong here
Microsoft Entra Connect does not store krbtgt keys or process Kerberos ticket granting requests locally within its synchronization database tables. Golden tickets are strictly an on-premises Active Directory attack vector targeting domain controllers directly via harvested account secrets.
- ✗
Exploiting seamless single sign-on kerberos ticket requests to harvest master keys directly from the Microsoft Entra ID service bus.
Why it's wrong here
Seamless SSO utilizes standard Kerberos authentication within the corporate network boundary to sign users into cloud services automatically. The Microsoft Entra ID service bus manages secure communication channels but does not store master keys accessible via ticket requests.
- ✓
Abusing compromised credentials against legacy authentication endpoints or poorly secured client applications that bypass modern conditional access and MFA controls.
Why this is correct
Pass-through authentication relies on valid directory credentials. When attackers capture these credentials, they often target legacy protocols like POP3, IMAP, or SMTP which traditionally do not enforce modern conditional access policies or multi-factor authentication challenges.
- ✗
Modifying the cloud synchronization agent configuration file to downgrade password hashing algorithms from PBKDF2 to plain text.
Why it's wrong here
Password hash synchronization uses secure iterations of PBKDF2 on-premises before transmitting salted hashes to Microsoft Entra ID. The local agent configuration file is heavily restricted and cannot alter core cryptographic hashing standards enforced by the cloud service.
Visual reference
About these practice questions
This GPEN question is part of Courseiva's 298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.