PEN-200 Windows Privilege Escalation Practice Question
You have compromised a Windows host and obtained credentials for a low-privileged domain user. You discover that this user has 'GenericWrite' permissions on a computer object in Active Directory. Which attack technique can you use to escalate privileges on that computer?
⚠ Common exam trap
The trap here is assuming that GenericWrite on a computer object directly grants administrative access, when it actually enables attribute modification that can be leveraged for RBCD.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Resource-Based Constrained Delegation (RBCD) by modifying the computer's msDS-AllowedToActOnBehalfOfOtherIdentity attribute.
GenericWrite on a computer object permits modification of its attributes. Setting msDS-AllowedToActOnBehalfOfOtherIdentity enables Resource-Based Constrained Delegation, allowing a controlled account to impersonate users to that computer. This can lead to full compromise of the target machine. The other techniques require different permissions or local access, making them ineffective here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a Kerberoasting attack to extract service account hashes.
Why it's wrong here
Kerberoasting targets service accounts with SPNs and does not require GenericWrite permissions on a computer object. It involves requesting TGS tickets and cracking them offline. Since the scenario grants GenericWrite on a computer, Kerberoasting is unrelated and would not leverage this permission to escalate on that specific computer.
- ✓
Use Resource-Based Constrained Delegation (RBCD) by modifying the computer's msDS-AllowedToActOnBehalfOfOtherIdentity attribute.
Why this is correct
GenericWrite on a computer object allows modification of its attributes, including msDS-AllowedToActOnBehalfOfOtherIdentity. By setting this attribute to include a controlled account, you can configure RBCD, enabling that account to impersonate any user to the target computer, effectively escalating to administrative access on that machine.
- ✗
Exploit an unquoted service path on the target computer.
Why it's wrong here
Unquoted service path exploitation requires local access to the target computer and write permissions to a directory in the service path. GenericWrite in Active Directory does not provide local file system access or the ability to create files on the target. Thus, this technique is not applicable in this scenario.
- ✗
Conduct a DCSync attack to replicate domain controller hashes.
Why it's wrong here
DCSync requires Replicating Directory Changes permissions, typically held by domain admins or specific service accounts. GenericWrite on a computer object does not grant these replication rights. Therefore, DCSync is not feasible with this permission alone and would fail due to insufficient privileges.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.