PEN-200 Active Directory Attacks Practice Question
You have compromised a service account that has the SeEnableDelegationPrivilege right on a domain controller. You want to abuse Kerberos delegation to gain access to a target server's file share. Which two steps are required to configure and exploit unconstrained delegation on a controlled computer object? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse unconstrained delegation, which relies on the TRUSTED_FOR_DELEGATION flag and TGT capture, with constrained delegation, which uses msDS-AllowedToDelegateTo and SPNs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the TRUSTED_FOR_DELEGATION flag on the controlled computer object so the domain controller will forward TGTs to it.
Unconstrained delegation abuse requires two things: enabling the TRUSTED_FOR_DELEGATION flag on a controlled computer so the DC forwards TGTs to it, and coercing a privileged user to authenticate to that computer so a TGT is cached in memory. Extracting the TGT then allows impersonation. The other options describe constrained delegation, an unrelated SPN configuration, or a security control that blocks the attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Service Principal Name on the controlled computer object for the target file share service (cifs/target).
Why it's wrong here
SPNs are used for Kerberoasting and for constrained delegation targeting, not for unconstrained delegation. Setting an SPN on the controlled computer does not cause the DC to forward TGTs to it. This step is irrelevant to enabling unconstrained delegation and would not contribute to capturing a privileged user's credentials.
- ✓
Set the TRUSTED_FOR_DELEGATION flag on the controlled computer object so the domain controller will forward TGTs to it.
Why this is correct
Unconstrained delegation requires the TRUSTED_FOR_DELEGATION userAccountControl flag on the computer object. With SeEnableDelegationPrivilege, you can set this flag on a machine you control. The domain controller then includes that computer in the list of services allowed to receive forwarded TGTs, which is the foundational configuration for this attack.
- ✗
Modify the msDS-AllowedToDelegateTo attribute on the controlled computer to include the target server's CIFS service.
Why it's wrong here
msDS-AllowedToDelegateTo is used for constrained delegation, which restricts delegation to specific services. Unconstrained delegation does not use this attribute; it relies on the TRUSTED_FOR_DELEGATION flag. Configuring this attribute would set up a different delegation model and does not enable the TGT capture that unconstrained delegation provides.
- ✗
Add the controlled computer to the Protected Users group to ensure delegation tokens are cached securely.
Why it's wrong here
The Protected Users group prevents delegation and blocks caching of credentials that would otherwise be exposed. Adding a computer to this group would actively hinder the attack by preventing TGT caching. It is a security control, not a step in enabling or exploiting unconstrained delegation.
- ✓
Coerce a privileged user to authenticate to the controlled computer so its TGT is captured in memory and can be extracted.
Why this is correct
Once unconstrained delegation is enabled, any privileged user who authenticates to the controlled computer leaves a TGT in LSASS. Coercing authentication, for example via a printer or authentication trigger, causes the DC to forward a TGT. Extracting that TGT with Mimikatz or similar tooling then allows impersonation of the privileged user.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.