CISSP Identity and Access Management Practice Question
An attacker has obtained a Kerberos TGT and uses it to request service tickets for any resource in the domain. Which type of attack is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-the-ticket attack
A golden ticket attack involves forging a TGT, but pass-the-ticket uses a legitimate TGT obtained illegally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replay attack
Why it's wrong here
A replay attack involves capturing a legitimate authentication message or data stream and retransmitting it later to impersonate a user or gain unauthorized access. While Kerberos does use tickets, its protocol incorporates timestamps and nonces to prevent simple retransmission of old messages from succeeding. This attack differs from pass-the-ticket because it focuses on re-sending an *existing* communication rather than leveraging a *stolen credential* to generate *new* valid requests.
- ✓
Pass-the-ticket attack
Why this is correct
A Pass-the-Ticket attack leverages a legitimately obtained Kerberos Ticket Granting Ticket (TGT) or its associated session key, which an attacker extracts from memory on a compromised host or user session. With this stolen TGT, the attacker can then request new Service Tickets (STs) from the Key Distribution Center (KDC) for various services, effectively authenticating as the original user without needing their plaintext password. This grants the attacker access to resources the compromised user is authorized to use.
- ✗
Golden ticket attack
Why it's wrong here
A Golden Ticket attack involves forging a Ticket Granting Ticket (TGT) rather than stealing an existing one. This sophisticated attack requires an attacker to compromise the Kerberos Key Distribution Center (KDC) by obtaining the NTLM hash of the KRBTGT account. With this hash, the attacker can craft a TGT for any user, with arbitrary privileges and an extended lifetime, granting persistent, full administrative control over the entire domain without ever interacting with the legitimate KDC.
- ✗
Kerberos cracking
Why it's wrong here
Kerberos cracking, while not a standard attack name, typically refers to offline brute-forcing or dictionary attacks against password hashes derived from Kerberos authentication requests. For instance, an attacker might capture an AS-REQ message containing a hash of the user's password (pre-authentication data) and attempt to crack it offline to recover the plaintext password. This process aims to discover the user's password, which is distinct from using an already obtained TGT to authenticate.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.