PEN-200 Active Directory Attacks Practice Question
You have obtained a plaintext password for a domain user and want to quickly identify which domain-joined systems the account can access with local administrative rights, without triggering account lockout. Which approach is most appropriate?
⚠ Common exam trap
The trap here is assuming that brute-forcing or password spraying is needed to test access, when valid credentials should be used directly to avoid lockout and unnecessary noise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CrackMapExec with the -u and -p options against a list of hosts and the smb module to check for administrative access.
CrackMapExec with valid credentials is the standard tool for quickly checking administrative access across many hosts. It performs a single authentication per host using the known password, avoiding lockout, and reports whether the account has local admin rights. Alternatives either risk lockout, capture unrelated credentials, or collect session data that does not directly answer the access question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use CrackMapExec with the -u and -p options against a list of hosts and the smb module to check for administrative access.
Why this is correct
CrackMapExec's smb module with valid credentials performs a single authentication attempt per host, checking for administrative access without repeated failed logons. This avoids lockout because it uses the correct password and does not spray. It efficiently identifies which systems grant local admin rights to the compromised account.
- ✗
Execute BloodHound with SharpHound using the -c Session collection method to enumerate where the user has administrative rights.
Why it's wrong here
SharpHound's Session collection gathers logged-on sessions from target hosts, which indicates where the user is currently logged on, not where they have administrative rights. While useful for lateral movement planning, it does not directly test administrative access. It also requires network access to each host's registry or SMB service to collect session data.
- ✗
Use Hydra to brute-force the password against SMB on each host to confirm administrative access.
Why it's wrong here
Brute-forcing with Hydra generates many failed authentication attempts and will trigger account lockout policies. Since the plaintext password is already known, brute-forcing is unnecessary and actively harmful to the engagement. This approach risks locking the account and disrupting the assessment.
- ✗
Run Responder on the network to poison LLMNR and capture administrative credentials from other hosts.
Why it's wrong here
Responder poisons name resolution to capture credentials from other users; it does not test whether the known account has local admin rights. This technique is unrelated to the goal of mapping access with a known credential and could introduce unnecessary network disruption. It also does not answer the question of which systems the account can administer.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.