I85PREP
⌘ K
HTB CAPE study materials
HTB CAPE study resources

HTB CAPE practice questions

One question at a time. Build your HTB CAPE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Active Directory Fundamentals and Enumeration

In Active Directory, which file on a domain controller stores the directory database that LDAP queries are served from?

  1. NTUSER.DAT
  2. SAM
  3. NTDS.dit Correct answer.
  4. SYSVOL\Policies

Explanation

Every domain controller keeps a writable copy of the directory in the Extensible Storage Engine database file NTDS.dit, located under %SystemRoot%\NTDS. LDAP searches, replication, and authentication lookups are all answered from this database, which is why it is the primary target when extracting domain credential material.

Question 2Active Directory Fundamentals and Enumeration

Which protocol and port combination does a client use to authenticate to Active Directory and request a Kerberos service ticket?

  1. LDAP over TCP 389
  2. Kerberos over TCP/UDP 88 Correct answer.
  3. SMB over TCP 445
  4. DNS over TCP/UDP 53

Explanation

Kerberos authentication, including AS-REQ/AS-REP and TGS-REQ/TGS-REP exchanges, runs on port 88 over both TCP and UDP and is handled by the KDC service on domain controllers. LDAP, SMB, and DNS serve other directory, file-sharing, and name-resolution roles and do not issue Kerberos tickets.

Question 3Active Directory Fundamentals and Enumeration

An attacker runs a query and receives a list of users with the userAccountControl value 4194304. What does that flag indicate about those accounts?

  1. The accounts do not require Kerberos preauthentication. Correct answer.
  2. The accounts are disabled.
  3. The accounts are smartcard-only logons.
  4. The accounts have never expired passwords.

Explanation

The value 4194304 corresponds to UF_DONT_REQUIRE_PREAUTH, meaning the KDC will return an AS-REP encrypted with the user's key without first proving the requester knows that key. This enables offline password cracking, commonly performed with tools such as Rubeus or Impacket's GetNPUsers.

Question 4Active Directory Fundamentals and Enumeration

Which default Active Directory group grants its members the right to replicate directory changes from a domain controller, making it a high-value privilege escalation target?

  1. Backup Operators
  2. Domain Controllers Correct answer.
  3. Domain Admins
  4. Account Operators

Explanation

Members of Domain Controllers hold the replication permissions needed to pull directory data, and any account added to this group on a DC can perform DCSync-style replication. Because replication exposes password hashes and other secrets, control of this group effectively equals domain compromise.

Question 5Active Directory Fundamentals and Enumeration

A penetration tester resolves the SRV record _ldap._tcp.dc._msdcs.corp.example and receives several hostnames. What is the most direct use of this result during enumeration?

  1. It lists global catalog servers only.
  2. It reveals the PDC emulator for the forest.
  3. It identifies domain controllers that can be queried over LDAP. Correct answer.
  4. It enumerates Kerberos service principal names.

Explanation

The _ldap._tcp.dc._msdcs SRV record is published by domain controllers and resolves to the DCs of the domain, giving an enumerator a reliable list of LDAP endpoints. Querying it is a standard first step before anonymous or authenticated LDAP binding.

Question 6Active Directory Fundamentals and Enumeration

During enumeration you observe a computer object whose primaryGroupID attribute is 515. Which interpretation is correct?

  1. The computer is disabled.
  2. The computer is a domain controller.
  3. The computer is a member workstation or server. Correct answer.
  4. The computer is a read-only domain controller.

Explanation

For computer accounts, primaryGroupID 515 maps to Domain Computers, which is the default for ordinary member workstations and servers joined to the domain. Domain controllers instead carry 516 (Domain Controllers), and read-only DCs use 521.

Question 7Active Directory Fundamentals and Enumeration

Which LDAP attribute on a user object most reliably indicates the last time the account successfully authenticated to the domain?

  1. lastLogonTimestamp Correct answer.
  2. logonCount
  3. accountExpires
  4. pwdLastSet

Explanation

lastLogonTimestamp is replicated between domain controllers and records the approximate time of the last interactive logon, making it the practical attribute for identifying active accounts across the domain. lastLogon is more precise but is not replicated, so it must be read from each DC.

Question 8Active Directory Fundamentals and Enumeration

What is the primary purpose of the SYSVOL share on a domain controller?

  1. Storing the directory database for replication
  2. Hosting Group Policy objects and logon scripts replicated to all DCs Correct answer.
  3. Caching Kerberos tickets for offline logon
  4. Providing a writable share for user home directories

Explanation

SYSVOL is replicated to every domain controller and contains the Policies and Scripts folders that deliver Group Policy settings and logon scripts to clients. Because it is readable by authenticated users, it is a common place to hunt for credentials embedded in scripts and preference files.

Question 9Active Directory Fundamentals and Enumeration

Which tool from the Impacket suite is used to perform LDAP-based enumeration of Active Directory, including users, groups, and computers, using a supplied domain credential?

  1. ldapsearch Correct answer.
  2. GetNPUsers.py
  3. secretsdump.py
  4. GetUserSPNs.py

Explanation

ldapsearch is the general-purpose LDAP query client that, when pointed at a domain controller with a valid bind, can retrieve user, group, and computer objects using filters and attribute lists. Impacket's Python scripts serve narrower purposes such as AS-REP roasting or SPN enumeration.

Question 10Active Directory Fundamentals and Enumeration

A user object has the attribute servicePrincipalName populated with MSSQLSvc/sql01.corp.example:1433. What attack does this configuration most directly enable?

  1. Pass-the-hash
  2. AS-REP roasting
  3. Kerberoasting Correct answer.
  4. Golden ticket creation

Explanation

Any account with a service principal name can have a service ticket requested by any authenticated user, and that ticket is encrypted with the service account's password-derived key. An attacker can request the ticket and crack it offline, which is the essence of Kerberoasting.

Question 11Active Directory Fundamentals and Enumeration

Which built-in account is disabled by default and has a well-known relative identifier of 500 in the domain?

  1. krbtgt
  2. Administrator Correct answer.
  3. DefaultAccount
  4. Guest

Explanation

The built-in Administrator account has RID 500 and is disabled by default on modern Windows domain installations, though it can be enabled by policy. Because its RID is fixed, it can be identified even if renamed, which matters during enumeration.

Question 12Active Directory Fundamentals and Enumeration

An enumeration script reports that the domain functional level is Windows Server 2016. What does this value most directly determine?

  1. The AD features available in the domain and which DC operating systems are supported Correct answer.
  2. The maximum number of domain controllers the domain can host
  3. The forest-wide schema version
  4. The password policy applied to all users

Explanation

The domain functional level gates which directory features are enabled and the minimum domain controller operating system permitted in the domain. It is distinct from the forest functional level, which governs forest-wide capabilities such as the recycle bin.

Question 13Active Directory Fundamentals and Enumeration

Which LDAP search base and filter would most directly return all user objects in the corp.example domain while excluding computers and groups?

  1. Base cn=Users,dc=corp,dc=example with filter (objectClass=*)
  2. Base cn=Computers,dc=corp,dc=example with filter (sAMAccountName=*)
  3. Base dc=corp,dc=example with filter (objectClass=user) Correct answer.
  4. Base dc=corp,dc=example with filter (objectCategory=computer)

Explanation

Searching from the domain root with the filter (objectClass=user) returns user objects across all organizational units, which is broader than limiting to the default Users container. Note that computer objects also carry objectClass=user, so a stricter filter such as (objectCategory=person) is often used to exclude them.

Question 14Active Directory Fundamentals and Enumeration

A tester discovers that an unauthenticated LDAP bind to a domain controller succeeds and returns directory data. Which misconfiguration does this indicate?

  1. Anonymous LDAP bind is permitted on the DC. Correct answer.
  2. NTLM authentication has been disabled by policy.
  3. Kerberos preauthentication is disabled domain-wide.
  4. The SYSVOL share allows anonymous write access.

Explanation

When a DC accepts a simple bind with no credentials and returns objects, anonymous LDAP access has not been restricted, which is controlled by the dsHeuristics attribute and default ACLs. This exposes directory structure such as users, groups, and password policy without any credential.

Question 15Active Directory Fundamentals and Enumeration

What information does the Active Directory domain rootDSE object provide to an enumerator?

  1. A list of all domain user password hashes
  2. The Kerberos master key for the domain
  3. Naming contexts, supported LDAP controls, and the domain DNS name Correct answer.
  4. The full group policy link order for the forest

Explanation

The rootDSE is a readable entry at the top of the LDAP tree that advertises server capabilities such as defaultNamingContext, supportedLDAPVersion, and supported controls. Enumerators query it first to learn the naming context before running deeper searches.

Question 16Active Directory Fundamentals and Enumeration

A computer account in the domain has the attribute ms-Mcs-AdmPermitted populated. What does this most likely indicate?

  1. The host is excluded from Group Policy processing.
  2. The host is a read-only domain controller.
  3. The host is managed by Microsoft Configuration Manager and uses LAPS for local admin passwords. Correct answer.
  4. The host trusts all forest users for delegation.

Explanation

The ms-Mcs-AdmPermitted attribute is written by the legacy Microsoft LAPS solution to store the randomized local administrator password for a managed computer. Reading it, where permissions allow, yields the local admin credential for that host.

Question 17Active Directory Fundamentals and Enumeration

Which of the following best describes a Kerberos service ticket (TGS) as observed during enumeration?

  1. It is encrypted with the user's NT hash and usable only on the issuing workstation.
  2. It is encrypted with the krbtgt account key and valid for the whole forest.
  3. It is encrypted with the target service account key and scoped to that service. Correct answer.
  4. It is signed by the domain trust key and valid across external forests.

Explanation

A service ticket is issued by the KDC and encrypted with the long-term key of the account running the target service, which is why cracking it reveals that account's password. Its scope is the specific service named in the ticket, unlike a TGT.

Question 18Active Directory Fundamentals and Enumeration

During reconnaissance you find the domain trusts a second forest with a two-way forest trust. What enumeration benefit does this provide?

  1. It replicates the trusted forest's NTDS.dit to the local DC.
  2. It allows querying users and groups in the trusted forest through the trust. Correct answer.
  3. It disables SID filtering between the forests.
  4. It grants immediate domain admin rights in the trusted forest.

Explanation

A forest trust enables authentication and directory lookups across the trust boundary, so an authenticated principal in one forest can often enumerate objects in the other, subject to permissions. It does not confer administrative rights or replicate databases.

Question 19Active Directory Fundamentals and Enumeration

Which attribute holds the Security Identifier of a group's members when reading a group object directly from LDAP?

  1. member Correct answer.
  2. sAMAccountName
  3. objectSid
  4. distinguishedName

Explanation

The member attribute is a multi-valued list of distinguished names of the group's members. To convert those to SIDs an enumerator resolves each DN's objectSid, or uses the tokenGroups attribute which returns SIDs directly.

Question 20Active Directory Fundamentals and Enumeration

A tester obtains a list of accounts from a domain controller and notices the attribute userAccountControl value 66048 on several of them. Which combination does this value represent?

  1. Trusted-for-delegation account with no preauthentication
  2. Normal account with a password that never expires Correct answer.
  3. Disabled account with a password that never expires
  4. Smartcard-required account that is disabled

Explanation

The value 66048 is the sum of UF_NORMAL_ACCOUNT (512) and UF_DONT_EXPIRE_PASSWD (65536), so the accounts are ordinary enabled users whose passwords do not expire. Such accounts are attractive targets because a compromised password remains valid indefinitely.

Question 21Active Directory Fundamentals and Enumeration

Which command-line utility built into Windows can be used to query Active Directory for objects using an LDAP filter without installing third-party tools?

  1. dsquery Correct answer.
  2. whoami
  3. netstat
  4. nltest

Explanation

dsquery is a built-in tool that issues LDAP queries against the directory using filters such as user, group, or computer, and can output distinguished names for further processing. It is commonly used during authenticated enumeration from a domain-joined host.

Question 22Active Directory Fundamentals and Enumeration

An account has the userAccountControl flag TRUSTED_FOR_DELEGATION set. What risk does this introduce during enumeration?

  1. The account can request service tickets for any user to any service, enabling impersonation. Correct answer.
  2. The account bypasses Kerberos preauthentication on logon.
  3. The account is exempt from password complexity policy.
  4. The account can read all password hashes from the directory.

Explanation

Unconstrained delegation lets a service cache and reuse a user's TGT, so an attacker who compromises such an account can impersonate any user who authenticates to it. This is why accounts with TRUSTED_FOR_DELEGATION are flagged as high-value during enumeration.

Question 23Active Directory Fundamentals and Enumeration

Which port and service is used for the global catalog, which an enumerator queries to search objects across all domains in a forest?

  1. TCP 389
  2. TCP 88
  3. TCP 636
  4. TCP 3268 Correct answer.

Explanation

The global catalog listens on TCP 3268 for LDAP and TCP 3269 for LDAP over SSL, and it holds a partial replica of every domain in the forest. Querying it lets an enumerator find objects in other domains without contacting each DC individually.

Question 24Active Directory Fundamentals and Enumeration

A tester enumerates a domain and finds that the krbtgt account password was last set several years ago. Why is this significant?

  1. It proves the account is disabled.
  2. It indicates a long-lived key that could forge golden tickets if compromised. Correct answer.
  3. It means the domain has no password policy.
  4. It shows the domain functional level is outdated.

Explanation

The krbtgt account key encrypts TGTs, and if that key is captured it can be used to mint arbitrary golden tickets. A key that has not been rotated in years widens the window in which a stolen key remains valid, so its age is a meaningful finding.

Question 25Active Directory Fundamentals and Enumeration

Which of the following is the most reliable way to determine the distinguished name of the domain's default naming context during an LDAP enumeration?

  1. Query the DNS A record for the domain name.
  2. Inspect the local SAM database.
  3. Run whoami /all on the local host.
  4. Read the defaultNamingContext attribute from the rootDSE. Correct answer.

Explanation

The rootDSE exposes defaultNamingContext, which contains the distinguished name of the domain partition, such as DC=corp,DC=example. Enumerators read it to set the correct search base before issuing object queries.

Question 26Active Directory Fundamentals and Enumeration

An enumerator wants to identify every domain controller in the corp.example domain without querying each server individually. Which LDAP query target returns those objects directly?

  1. A subtree search of CN=Users,DC=corp,DC=example filtered on objectClass=computer
  2. A subtree search of CN=Configuration,DC=corp,DC=example filtered on objectClass=nTDSDSA
  3. A base search of the domain rootDSE requesting the supportedControl attribute
  4. A subtree search of the domain naming context filtered on objectCategory=computer and the server objectCategory Correct answer.

Explanation

Domain controller computer accounts carry the server objectCategory and live under the domain naming context, so filtering computer objects on that category returns the DCs along with other servers. The nTDSDSA objects under the Configuration partition describe directory service agents but do not carry the host naming data an enumerator usually wants.

Question 27Active Directory Fundamentals and Enumeration

While reviewing a user object you see the attribute memberOf populated with several distinguished names. What does this attribute represent for that account?

  1. The access control entries that grant the user rights over directory objects
  2. Only groups where the user is a direct member, excluding nested group chains Correct answer.
  3. The groups the user belongs to, including nested memberships resolved by the directory
  4. The organizational units that contain the user object in the directory tree

Explanation

memberOf is a back-link attribute maintained by the directory: it lists groups in which the account is a direct member and does not expand nested group chains. An enumerator therefore must resolve nested membership separately, for example by reading the member attribute of parent groups.

Question 28Active Directory Fundamentals and Enumeration

During enumeration you collect the domain's password policy and observe that the lockout threshold is 0. How should this affect a password spraying attempt?

  1. Spraying is unsafe because any failed attempt locks every targeted account
  2. Spraying is safe from lockout because accounts are never locked by bad passwords Correct answer.
  3. Spraying is impossible because the policy also disables password authentication
  4. Spraying must be limited to one attempt per account per lockout observation window

Explanation

A lockout threshold of 0 means the account lockout policy is not enforced, so failed authentications do not lock accounts. This makes low-and-slow spraying far less risky, though detection by monitoring and alerting can still occur.

Question 29Active Directory Fundamentals and Enumeration

An enumerator queries the rootDSE of a domain controller and reads the configurationNamingContext, schemaNamingContext, and defaultNamingContext values. Why is defaultNamingContext especially useful?

  1. It supplies the distinguished name to use as the search base for domain objects Correct answer.
  2. It exposes the SYSVOL path used for Group Policy preference files
  3. It reveals the forest-wide schema version so the tester can pick exploits
  4. It lists the global catalog servers available for cross-domain searches

Explanation

defaultNamingContext returns the distinguished name of the domain naming context, which is the natural search base for enumerating users, groups, and computers in that domain. The other rootDSE values describe schema, configuration, and forest-wide settings rather than the domain object base.

Question 30Active Directory Fundamentals and Enumeration

A tester notices that a group named Helpdesk has the member attribute containing a computer account, and that this group is itself a member of the Domain Admins group. What is the most significant enumeration finding?

  1. The computer account gains domain administrator rights through transitive nested membership Correct answer.
  2. The nesting is inert because Domain Admins ignores group membership from other groups
  3. The computer account can only read helpdesk mailboxes and poses no privilege risk
  4. The group is misconfigured because computers cannot be members of security groups

Explanation

Group membership is transitive, so a computer placed in Helpdesk inherits Domain Admins rights because Helpdesk is nested inside Domain Admins. An attacker controlling that machine account could then act with domain administrator privileges, making this a high-impact finding.

Question 31Initial Access and Foothold in AD Environments

During an internal assessment of an Active Directory environment, you capture NetNTLMv2 challenge-response hashes from a file share. Which technique allows you to authenticate as the victim user without cracking the hash?

  1. Kerberoasting
  2. Pass-the-Hash
  3. NTLM Relay Correct answer.
  4. AS-REP Roasting

Explanation

NTLM Relay forwards captured NetNTLMv2 authentication attempts to another service, authenticating as the victim without knowing the plaintext password or cracking the hash. Pass-the-Hash requires an NTLM hash, not a NetNTLMv2 challenge-response. Kerberoasting and AS-REP Roasting target Kerberos service tickets and pre-authentication data, respectively, and do not use captured NetNTLMv2 exchanges.

Question 32Initial Access and Foothold in AD Environments

Which Active Directory misconfiguration directly enables an attacker to perform a Kerberoasting attack against a service account?

  1. The service account is a member of the Domain Admins group.
  2. The service account has unconstrained delegation enabled.
  3. The service account has a Service Principal Name (SPN) registered. Correct answer.
  4. The service account is configured with 'Do not require Kerberos preauthentication'.

Explanation

Kerberoasting abuses the fact that any authenticated user can request a Kerberos service ticket for any account with an SPN. The ticket is encrypted with the service account's password hash and can be cracked offline. Preauthentication settings relate to AS-REP Roasting, group membership does not affect ticket requestability, and delegation is a separate privilege escalation vector.

Question 33Initial Access and Foothold in AD Environments

You have obtained a low-privileged domain user account and want to enumerate all computers in the domain where unconstrained delegation is enabled. Which tool or technique is most directly suited for this?

  1. Responder with the --wpad flag
  2. Impacket's GetNPUsers.py
  3. Mimikatz with the sekurlsa::logonpasswords command
  4. BloodHound with the 'Unconstrained Delegation' edge query Correct answer.

Explanation

BloodHound maps Active Directory relationships, and its queries can reveal computers configured for unconstrained delegation, which are attractive targets for privilege escalation. Responder poisons name resolution traffic, Mimikatz extracts credentials from memory, and GetNPUsers.py performs AS-REP Roasting; none directly enumerate delegation settings.

Question 34Initial Access and Foothold in AD Environments

An attacker with domain user credentials wants to abuse AD CS ESC1. Which condition must be present on a certificate template for this attack to succeed?

  1. The template enforces strong certificate mapping with SID extension.
  2. The template is published only to Domain Controllers.
  3. The template requires manager approval for all enrollment requests.
  4. The template allows enrollee-supplied subject alternative names and grants enrollment to low-privileged users. Correct answer.

Explanation

ESC1 requires a template that permits the requester to specify a subjectAltName (SAN) and is enrollable by unprivileged users, allowing them to request a certificate impersonating a privileged account. Manager approval or restricted publication would block the attack, and strong certificate mapping mitigates impersonation.

Question 35Initial Access and Foothold in AD Environments

Which protocol is commonly targeted by LLMNR/NBT-NS poisoning to capture NetNTLMv2 hashes from users on a local network segment?

  1. SMB Correct answer.
  2. Kerberos
  3. LDAP
  4. DNS

Explanation

LLMNR and NBT-NS poisoning tricks victims into authenticating to the attacker's host over SMB, yielding NetNTLMv2 challenge-response hashes. Kerberos and LDAP are not used in this broadcast name resolution poisoning scenario, and DNS is the legitimate name resolution protocol that the attack circumvents.

Question 36Initial Access and Foothold in AD Environments

You have compromised a workstation and extracted an NTLM hash for a domain user. Which attack can you perform to move laterally to another server without knowing the plaintext password?

  1. Pass-the-Ticket
  2. Golden Ticket
  3. Pass-the-Hash Correct answer.
  4. Kerberoasting

Explanation

Pass-the-Hash uses the captured NTLM hash directly in the NTLM authentication process to authenticate to remote systems. Pass-the-Ticket requires a Kerberos ticket, Kerberoasting is for offline cracking of service account passwords, and a Golden Ticket requires the KRBTGT hash.

Question 37Initial Access and Foothold in AD Environments

What is the primary purpose of the Responder tool during an internal penetration test?

  1. To poison LLMNR, NBT-NS, and mDNS responses to capture authentication hashes. Correct answer.
  2. To enumerate Active Directory objects via LDAP queries.
  3. To relay NTLM authentication to LDAP for directory modifications.
  4. To perform Kerberos ticket requests and crack service account passwords.

Explanation

Responder listens for broadcast name resolution requests and responds to them, tricking victims into sending NetNTLMv2 hashes to the attacker. Kerberoasting is typically done with other tools, LDAP enumeration uses tools like BloodHound or AdFind, and NTLM relay to LDAP is a separate technique often performed with ntlmrelayx.

Question 38Initial Access and Foothold in AD Environments

Which Active Directory object attribute, when writable by a low-privileged user, can be abused to perform a targeted Kerberoasting attack?

  1. msDS-AllowedToDelegateTo
  2. servicePrincipalName Correct answer.
  3. userAccountControl
  4. memberOf

Explanation

If a user has write access to the servicePrincipalName attribute of another account, they can add an SPN to that account and then request a Kerberos service ticket for it, enabling targeted Kerberoasting. userAccountControl controls account settings, msDS-AllowedToDelegateTo is for constrained delegation, and memberOf is group membership.

Question 39Initial Access and Foothold in AD Environments

During an assessment, you identify a computer account with unconstrained delegation. Which action allows you to capture the credentials of a Domain Admin who authenticates to that computer?

  1. Use Responder to poison LLMNR requests from the Domain Admin.
  2. Run Rubeus monitor to capture TGTs from incoming Kerberos authentication. Correct answer.
  3. Perform a Kerberoast attack against the computer account.
  4. Use Mimikatz to perform a DCSync attack.

Explanation

When a Domain Admin authenticates to a computer with unconstrained delegation, their TGT is stored in LSASS. Rubeus monitor can extract these TGTs, which can then be used for pass-the-ticket. DCSync requires replication privileges, Kerberoasting the computer account is not applicable, and Responder does not directly extract tickets from delegation.

Question 40Initial Access and Foothold in AD Environments

Which of the following is a requirement for a successful NTLM relay attack against SMB signing-disabled hosts?

  1. The victim must initiate an authentication request that the attacker can relay. Correct answer.
  2. The attacker must obtain the plaintext password of the victim.
  3. The attacker must have Domain Admin privileges.
  4. The target service must have SMB signing enabled.

Explanation

NTLM relay requires a victim to initiate an authentication attempt that the attacker can intercept and forward to a target service. The attacker does not need the plaintext password or elevated privileges, and SMB signing must be disabled (not enabled) on the target for relay to succeed.

Question 41Initial Access and Foothold in AD Environments

What is the purpose of the 'ms-DS-MachineAccountQuota' attribute in Active Directory?

  1. It sets the interval for Kerberos ticket renewal.
  2. It specifies the number of failed logon attempts before lockout.
  3. It controls the maximum number of SPNs an account can have.
  4. It defines the maximum number of machines a user can join to the domain. Correct answer.

Explanation

ms-DS-MachineAccountQuota controls how many computer accounts a non-privileged user can create in the domain, which by default is 10. Attackers can abuse this to create computer accounts for various attacks. The other options describe account lockout policy, SPN limits, and Kerberos policy, which are unrelated attributes.

Question 42Initial Access and Foothold in AD Environments

Which attack involves extracting the KRBTGT account hash to forge Kerberos tickets with arbitrary privileges?

  1. Skeleton Key
  2. Golden Ticket Correct answer.
  3. Silver Ticket
  4. DCSync

Explanation

A Golden Ticket attack forges a Ticket Granting Ticket (TGT) using the KRBTGT account hash, granting access as any user. A Silver Ticket forges a service ticket using a service account hash, Skeleton Key is a malware implant, and DCSync is a technique to replicate credentials including the KRBTGT hash.

Question 43Initial Access and Foothold in AD Environments

You are analyzing a potential AD CS ESC8 vulnerability. Which condition is necessary for an attacker to relay NTLM authentication to the certificate authority's HTTP enrollment endpoint?

  1. The CA must require certificate approval by a manager.
  2. The CA must have the Web Enrollment role installed and allow NTLM authentication. Correct answer.
  3. The CA must be configured with the 'Restrict Enrollment Agents' policy.
  4. The CA must have the 'Enforce Encryption' setting enabled.

Explanation

ESC8 exploits the CA Web Enrollment interface when it accepts NTLM authentication, allowing an attacker to relay a victim's authentication to request a certificate. Restricting enrollment agents or requiring manager approval would block the attack, and enforcing encryption does not mitigate relay.

Question 44Initial Access and Foothold in AD Environments

Which tool is commonly used to perform a Kerberoasting attack by requesting service tickets for accounts with SPNs?

  1. CrackMapExec
  2. GetUserSPNs.py Correct answer.
  3. BloodHound
  4. Mimikatz

Explanation

GetUserSPNs.py from Impacket queries Active Directory for accounts with SPNs and requests Kerberos service tickets, which can then be cracked offline. BloodHound maps relationships, Mimikatz extracts credentials, and CrackMapExec is used for lateral movement and command execution.

Question 45Initial Access and Foothold in AD Environments

During an internal assessment, you discover a Group Policy Preference (GPP) file containing a cpassword. Which action allows you to recover the plaintext password?

  1. Perform a brute-force attack against the cpassword.
  2. Use gpp-decrypt to decrypt the cpassword using the published AES key. Correct answer.
  3. Use Mimikatz to decrypt the cpassword with the domain SYSKEY.
  4. Use Responder to capture the cpassword in transit.

Explanation

Group Policy Preferences cpassword values are encrypted with a known AES key published by Microsoft, so tools like gpp-decrypt can immediately reveal the plaintext. The SYSKEY is not used for this, brute-forcing is unnecessary, and Responder does not decrypt GPP files.

Question 46Initial Access and Foothold in AD Environments

Which Active Directory permission, when granted on a user object, allows an attacker to perform a targeted Kerberoasting attack by adding an SPN?

  1. GenericAll Correct answer.
  2. GenericRead
  3. WriteOwner
  4. WriteDacl

Explanation

GenericAll grants full control over an object, including the ability to modify attributes such as servicePrincipalName, enabling targeted Kerberoasting. GenericRead only allows reading, WriteDacl allows modifying permissions, and WriteOwner allows changing ownership; none directly permit SPN modification.

Question 47Initial Access and Foothold in AD Environments

What is the primary defense against NTLM relay attacks in an Active Directory environment?

  1. Enforce SMB signing and disable NTLM authentication where possible. Correct answer.
  2. Use Kerberos pre-authentication for all accounts.
  3. Implement a password policy with a minimum length of 8 characters.
  4. Enable LLMNR and NBT-NS for faster name resolution.

Explanation

Enforcing SMB signing prevents tampering with relayed authentication, and disabling NTLM reduces the attack surface for relay. Enabling LLMNR/NBT-NS increases poisoning risk, Kerberos pre-authentication addresses AS-REP Roasting, and password length does not prevent relay.

Question 48Initial Access and Foothold in AD Environments

Which of the following is a characteristic of a Silver Ticket attack?

  1. It forges a TGT using the KRBTGT hash.
  2. It relies on AS-REP Roasting to obtain the ticket.
  3. It requires interaction with the Domain Controller for each authentication.
  4. It forges a Kerberos service ticket using a compromised service account's NTLM hash. Correct answer.

Explanation

A Silver Ticket is created by forging a service ticket with the service account's NTLM hash, allowing access to that specific service without contacting the DC. Golden Tickets use the KRBTGT hash, Silver Tickets are used offline, and AS-REP Roasting is unrelated.

Question 49Initial Access and Foothold in AD Environments

During an assessment, you find a server with unconstrained delegation and a Domain Admin logs on to it. Which attack can you then perform to escalate privileges domain-wide?

  1. NTLM relay to the Domain Controller.
  2. DCSync using the captured Domain Admin TGT. Correct answer.
  3. Kerberoasting the Domain Admin account.
  4. AS-REP Roasting the Domain Admin account.

Explanation

Capturing a Domain Admin's TGT from a host with unconstrained delegation allows pass-the-ticket to the Domain Controller, where DCSync can be performed to replicate credentials. Kerberoasting and AS-REP Roasting target different weaknesses, and NTLM relay is not directly enabled by delegation.

Question 50Initial Access and Foothold in AD Environments

What is the function of the 'ms-DS-AllowedToActOnBehalfOfOtherIdentity' attribute in resource-based constrained delegation (RBCD)?

  1. It sets the account's password policy.
  2. It defines which service can impersonate users to access the target resource. Correct answer.
  3. It specifies the SPNs for the account.
  4. It controls Kerberos ticket lifetime.

Explanation

In RBCD, the ms-DS-AllowedToActOnBehalfOfOtherIdentity attribute on a computer object lists the security principals allowed to impersonate users to that computer. SPNs are stored in servicePrincipalName, ticket lifetime is domain policy, and password policy is separate.