CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Golden ticket attack

  Why this is correct

  A golden ticket attack leverages a compromised Kerberos Key Distribution Center (KDC) account's NTLM hash (specifically, the krbtgt account) to forge a valid Ticket Granting Ticket (TGT). This forged TGT grants the attacker unlimited, domain-wide administrative access to all resources within the Active Directory environment. The attacker can impersonate any user, including non-existent ones, and request service tickets for any service without further authentication from the legitimate KDC.

• ✗

  Silver ticket attack

  Why it's wrong here

  A silver ticket attack involves forging a Kerberos service ticket (TGS) for a specific service on a particular server, rather than a TGT. This attack requires compromising the NTLM hash of the service account or machine account associated with the target service. The forged service ticket grants access only to that specific service, such as CIFS for file shares or HTTP for web services, without requiring interaction with the KDC for a TGT.

• ✗

  Pass-the-ticket attack

  Why it's wrong here

  Pass-the-ticket (PtT) is a post-exploitation technique where an attacker reuses a legitimate Kerberos TGT or service ticket that has been stolen from a compromised host's memory or file system. Unlike forging, PtT does not create new tickets but rather authenticates to services using an existing, valid ticket. This attack bypasses the need for the user's password hash, relying solely on the presence of a valid, unexpired ticket.

• ✗

  Kerberos poisoning attack

  Why it's wrong here

  Kerberos poisoning is a broader term encompassing various attacks that manipulate or exploit Kerberos protocol messages or configurations, often targeting the initial authentication request (AS-REQ/AS-REP). Examples include AS-REP Roasting, where an attacker requests TGTs for users configured with "Do not require Kerberos preauthentication" and then cracks the encrypted AS-REP offline. Another form involves manipulating Service Principal Names (SPNs) to trick clients into requesting tickets for malicious services or to facilitate other attacks.

Go deeper

Related to this question