Reporting and Remediation Guidance
What this domain tests
Reporting and Remediation Guidance tests translating technical compromise into a clear report and fixes. The exam expects evidence-backed findings, business impact, and remediation that an AD administrator can actually implement.
Core rules and concepts
- Structure: executive summary, scope, methodology, findings with evidence, risk rating, and remediation.
- Map findings to ATT&CK techniques such as Kerberoasting, DCSync, and ACL abuse.
- Remediation must be specific: gMSA for service accounts, enable pre-authentication, tiered admin, LAPS, SMB signing, LDAP signing, disable NTLM where possible, AD CS template hardening, and krbtgt reset twice.
- Redact hashes and sensitive data but preserve enough proof to reproduce the finding.
Worked example
Finding: service account svc-sql is Kerberoastable and its password cracked in two minutes. Evidence: SPN, extracted hash, cracking time, and group membership. Impact: any domain user can impersonate the service and reach the SQL tier. Remediation: migrate to gMSA, use a 25-plus character random password, enforce AES, and monitor event 4769 for RC4 ticket requests. Reasoning: the fix addresses the root cause, not just the cracked password.
Traps that cost marks
- Vague remediation such as patch systems or improve monitoring.
- Missing reproduction steps and timestamps for each finding.
- Exposing plaintext passwords or reusable hashes in the report.
- Failing to prioritize domain compromise over low-risk findings.
- Not explaining residual risk after remediation.