I85PREP
⌘ K
PNPT study materials
PNPT study resources

PNPT practice questions

One question at a time. Build your PNPT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Open-Source Intelligence (OSINT) reconnaissance

During an OSINT engagement you want to enumerate subdomains without touching the target's infrastructure directly. Which data source provides passive subdomain discovery by mining historical certificate transparency logs?

  1. Sending ICMP echo requests to a /24 range
  2. Brute-forcing DNS records with a wordlist resolver
  3. Querying crt.sh for certificates issued to the target domain Correct answer.
  4. Running a zone transfer against the authoritative nameserver

Explanation

Certificate transparency logs are public append-only records of issued TLS certificates, and services such as crt.sh index them so you can search for hostnames without sending any traffic to the target. This makes it a passive technique because the queries go to the third-party log, not the organization.

Question 2Open-Source Intelligence (OSINT) reconnaissance

An analyst runs `whois example.com` and reads the Registrar, Creation Date, and Name Server fields. What is the primary OSINT value of this record during reconnaissance?

  1. It lists every employee mailbox hosted on the domain
  2. It provides registration metadata and authoritative nameservers that guide further DNS enumeration Correct answer.
  3. It reveals the organization's internal Active Directory structure
  4. It discloses the web application's source code repository

Explanation

WHOIS returns registration metadata such as registrar, creation and expiry dates, registrant details, and the authoritative nameservers. The nameserver records tell you which DNS provider hosts the zone and are a useful pivot for later enumeration.

Question 3Open-Source Intelligence (OSINT) reconnaissance

You want to identify technologies powering a public web application using only HTTP responses. Which approach best fits passive OSINT collection?

  1. Running an authenticated vulnerability scan against the login form
  2. Uploading a webshell to test server permissions
  3. Inspecting response headers, cookies, and default error pages for framework fingerprints Correct answer.
  4. Port-scanning the host with a SYN sweep

Explanation

HTTP response headers (Server, X-Powered-By), cookie names, and default error pages carry signatures that reveal web servers, frameworks, and languages. Reading them is passive because you only observe what the server already returns.

Question 4Open-Source Intelligence (OSINT) reconnaissance

Which Google search operator would you use to restrict results to a specific site while searching for exposed documents?

  1. link:example.com pdf
  2. inurl:example.com ext:pdf
  3. site:example.com filetype:pdf Correct answer.
  4. cache:example.com pdf

Explanation

The `site:` operator limits results to a given domain, and `filetype:` filters by file extension, so combining them surfaces PDFs hosted on that site. This is a standard Google dorking pattern for document discovery.

Question 5Open-Source Intelligence (OSINT) reconnaissance

What does the `robots.txt` file typically disclose to an OSINT analyst?

  1. Paths the site owner asked crawlers to avoid, often revealing sensitive directories Correct answer.
  2. The full list of registered domain users
  3. The firewall rule set protecting the host
  4. The server's private SSH host keys

Explanation

robots.txt lists user-agent rules and Disallow entries that tell crawlers which paths to skip. Analysts read it because administrators sometimes list administrative or staging paths there, effectively advertising interesting locations.

Question 6Open-Source Intelligence (OSINT) reconnaissance

Which record type should you query to learn which mail servers accept email for a target domain?

  1. MX Correct answer.
  2. TXT
  3. CNAME
  4. A

Explanation

MX records map a domain to the mail exchanger hosts responsible for receiving its email. Enumerating them reveals the mail provider and potential infrastructure to investigate further.

Question 7Open-Source Intelligence (OSINT) reconnaissance

During OSINT you find a username and want to check which social platforms it is registered on. Which technique is most appropriate?

  1. Password spraying the discovered accounts
  2. Username enumeration across platforms using consistent handle checks Correct answer.
  3. Exploiting a known CVE on each platform
  4. Sending phishing emails to confirm account existence

Explanation

Checking whether the same handle exists across platforms is a passive, low-risk way to correlate a person's presence online. Tools and manual checks against profile URLs accomplish this without interacting with the account owner.

Question 8Open-Source Intelligence (OSINT) reconnaissance

Which of the following best describes the purpose of the Shodan search engine in OSINT?

  1. It provides DNS zone transfer services
  2. It archives deleted web pages for forensic review
  3. It indexes banners from internet-facing services to reveal exposed devices and versions Correct answer.
  4. It maps email addresses to physical addresses

Explanation

Shodan continuously scans the internet and indexes service banners, letting analysts search for exposed devices, software versions, and open ports without scanning the targets themselves. This makes it a passive way to profile an organization's external footprint.

Question 9Open-Source Intelligence (OSINT) reconnaissance

An analyst wants to discover email addresses associated with a target domain for a phishing-awareness assessment. Which OSINT source most directly supports this?

  1. The Wayback Machine's crawl of the site's contact pages Correct answer.
  2. An nmap service scan of port 25
  3. A WHOIS query for the registrar's abuse contact
  4. A reverse DNS lookup of the mail server

Explanation

Archived contact and staff pages frequently contain email addresses that may have since been removed from the live site, making the Wayback Machine a productive passive source. Reverse DNS and port scans reveal infrastructure, not individual addresses.

Question 10Open-Source Intelligence (OSINT) reconnaissance

You are reviewing a DNS TXT record containing `v=spf1 include:_spf.google.com -all`. What does this reveal to an OSINT analyst?

  1. The domain's primary website is hosted on Google Cloud
  2. The domain has no mail infrastructure configured
  3. The domain authorizes Google to send mail and rejects all other senders Correct answer.
  4. The domain uses DNSSEC to sign all records

Explanation

An SPF record lists the hosts authorized to send email for the domain; `include:_spf.google.com` authorizes Google's mail servers and `-all` instructs receivers to reject any other sender. This tells the analyst which mail provider the organization uses and how strictly it enforces sending policy.

Question 11Open-Source Intelligence (OSINT) reconnaissance

When performing OSINT on a company, you find employee profiles on LinkedIn listing job titles and technologies used. Which analysis technique best leverages this data?

  1. Using the profiles to guess and test passwords
  2. Contacting employees directly to confirm the information
  3. Reporting the profiles to the platform for removal
  4. Building an organizational chart and technology map to guide later targeting Correct answer.

Explanation

Public professional profiles reveal reporting structures, roles, and sometimes the tools an organization uses, which supports mapping the organization and its technology stack. This intelligence informs later phases without interacting with employees.

Question 12Open-Source Intelligence (OSINT) reconnaissance

Which query would you use to find pages on a target site that reference a specific file extension in their URL, using Google dorking?

  1. site:example.com cache:bak
  2. site:example.com ext:bak Correct answer.
  3. site:example.com intitle:bak
  4. site:example.com intext:bak

Explanation

The `ext:` operator filters results by the file extension in the URL, so `site:example.com ext:bak` surfaces backup files hosted on the domain. This is a common dork for finding accidentally exposed backups.

Question 13Open-Source Intelligence (OSINT) reconnaissance

An analyst runs a reverse image search on a photo posted by a target. What is the most likely OSINT objective?

  1. Extracting the photographer's email from the file
  2. Reading the image's EXIF GPS coordinates directly
  3. Determining the camera's serial number from the image
  4. Identifying other profiles or locations where the same image appears Correct answer.

Explanation

Reverse image search finds other pages hosting the same or similar image, which can reveal additional accounts, locations, or context about the subject. It does not parse metadata; that requires separate EXIF analysis.

Question 14Open-Source Intelligence (OSINT) reconnaissance

Which tool is designed to gather information about a domain's DNS, WHOIS, and hosting from multiple public sources in a single query?

  1. theHarvester Correct answer.
  2. John the Ripper
  3. Wireshark
  4. Metasploit

Explanation

theHarvester aggregates emails, hostnames, and related data from public sources such as search engines and certificate logs, making it a staple OSINT collection tool. The other options serve exploitation, packet capture, and password cracking respectively.

Question 15Open-Source Intelligence (OSINT) reconnaissance

You discover an organization's staging subdomain that resolves to a private IP address. What is the most reasonable OSINT conclusion?

  1. The subdomain is definitely a decoy with no value
  2. The record exists but the host is likely unreachable externally, indicating internal-only use Correct answer.
  3. The organization has no DNS management
  4. The private IP confirms the staging site is publicly accessible

Explanation

A DNS record pointing to an RFC 1918 private address indicates the hostname is intended for internal resolution and is not directly reachable from the internet. The record itself still confirms the naming convention and existence of the staging environment.

Question 16Open-Source Intelligence (OSINT) reconnaissance

What is the primary purpose of using a sock puppet account during social media OSINT?

  1. To impersonate a specific employee
  2. To gain unauthorized access to private groups
  3. To collect public information while separating the analyst's identity from the target Correct answer.
  4. To bypass the platform's terms of service

Explanation

A sock puppet is a separate, fictional persona used to view public content and interact where appropriate without exposing the analyst's real identity. It should still operate within platform rules and legal boundaries.

Question 17Open-Source Intelligence (OSINT) reconnaissance

An analyst wants to determine whether a target domain has been involved in a data breach. Which OSINT resource is most appropriate?

  1. A traceroute to the web server
  2. An HTTP OPTIONS request to the root path
  3. A DNS reverse lookup of the domain
  4. Have I Been Pwned's domain search Correct answer.

Explanation

Have I Been Pwned aggregates breach data and offers domain-level searches showing which accounts were exposed in known breaches. This provides breach intelligence without interacting with the target's systems.

Question 18Open-Source Intelligence (OSINT) reconnaissance

When collecting OSINT, why should an analyst document the source URL and retrieval timestamp for each finding?

  1. To increase the search engine ranking of the report
  2. To satisfy the target organization's marketing team
  3. To establish provenance and allow findings to be verified or reproduced later Correct answer.
  4. To encrypt the collected data automatically

Explanation

Recording the source and time of collection establishes provenance, so findings can be verified and changes over time can be tracked. This is fundamental to producing defensible intelligence reports.

Question 19Open-Source Intelligence (OSINT) reconnaissance

A target's website displays a copyright footer referencing an outdated company name. How should an OSINT analyst use this information?

  1. Report the website for trademark infringement
  2. Pivot on the old name to find historical registrations, domains, and archived pages Correct answer.
  3. Ignore it because footers are never useful
  4. Assume the current company is defunct

Explanation

Legacy names in footers often lead to older registrations, related domains, and archived content that reveal the organization's history and infrastructure. Pivoting on that name can surface assets the current branding hides.

Question 20Open-Source Intelligence (OSINT) reconnaissance

Which of the following is an example of active reconnaissance rather than passive OSINT?

  1. Reading cached pages from an archive service
  2. Sending crafted DNS queries directly to the target's authoritative server Correct answer.
  3. Browsing an organization's public social media
  4. Querying a search engine for indexed pages

Explanation

Active reconnaissance sends traffic directly to the target's systems, so querying its authoritative DNS server counts as active because the target can observe the request. Passive techniques rely on third-party data sources.

Question 21Open-Source Intelligence (OSINT) reconnaissance

An analyst finds a publicly exposed `.git` directory on a target web server. What is the most significant OSINT implication?

  1. The server is guaranteed to be running Windows
  2. The site uses no version control at all
  3. The repository may expose source code, commit history, and embedded secrets Correct answer.
  4. The directory proves the site is a honeypot

Explanation

An exposed .git directory can allow reconstruction of the repository, revealing source code, commit history, and secrets committed by mistake. This is a high-value finding that often leads to further compromise paths.

Question 22Open-Source Intelligence (OSINT) reconnaissance

During a passive DNS review you notice many subdomains resolving to the same IP address that also hosts unrelated third-party sites. What does this most likely indicate?

  1. The target owns all the unrelated sites
  2. The IP address is a private address
  3. The target uses shared hosting, so IP-based attribution is unreliable Correct answer.
  4. The DNS records are forged

Explanation

Shared hosting places many unrelated domains on one IP, so attributing all sites on that address to the target would be incorrect. Analysts must treat IP-based pivots cautiously and verify ownership through other evidence.

Question 23Open-Source Intelligence (OSINT) reconnaissance

An analyst wants to attribute a malicious email to an infrastructure cluster. Which combination of OSINT artifacts provides the strongest passive correlation?

  1. SPF/DKIM alignment, sending IP WHOIS, and passive DNS history of the sending domain Correct answer.
  2. The email client's display name
  3. The email's subject line and font
  4. The recipient's mailbox size

Explanation

Mail authentication results, registration data for the sending IP, and historical DNS resolution together form a defensible infrastructure picture. Correlating independent passive sources reduces the chance of misattribution.

Question 24Open-Source Intelligence (OSINT) reconnaissance

A target organization publishes job postings mentioning a specific VPN appliance and SIEM product. How should an OSINT analyst interpret this?

  1. As proof the products are vulnerable and exploitable
  2. As evidence the postings are fabricated
  3. As a technology-stack indicator that should be corroborated with other passive evidence Correct answer.
  4. As confirmation of the exact firmware version in use

Explanation

Job postings often reveal tools in use, but they are indirect indicators that may reflect planned rather than deployed technology. The finding should be corroborated with other passive sources before being treated as fact.

Question 25Open-Source Intelligence (OSINT) reconnaissance

You are building a target profile and find the same individual's handle across a forum, a code repository, and a photo-sharing site, with overlapping bios. What is the appropriate analytic conclusion?

  1. Proof the accounts are run by a botnet
  2. A probable identity correlation supported by multiple independent artifacts Correct answer.
  3. A coincidence with no intelligence value
  4. Certain identification requiring no further verification

Explanation

Overlapping handles and bios across independent platforms provide corroborating evidence for a probable identity correlation, but OSINT conclusions should be expressed with appropriate confidence rather than as certainty. Additional artifacts can strengthen or weaken the link.

Question 26Open-Source Intelligence (OSINT) reconnaissance

An analyst wants to enumerate subdomains of a target using only public certificate transparency logs. Which resource most directly supports this?

  1. The target's WHOIS registrant record
  2. The target's robots.txt file
  3. crt.sh queried for the target's registered domain Correct answer.
  4. A Bing site: search for the apex domain

Explanation

Certificate transparency logs record every certificate issued by participating CAs, including the hostnames in the SAN field, so querying a CT aggregator such as crt.sh by domain reveals subdomains without touching the target. This is passive collection because the data is already published by the logging infrastructure.

Question 27Open-Source Intelligence (OSINT) reconnaissance

During passive reconnaissance an analyst needs historical IP-to-hostname mappings for a domain that no longer resolve today. Which data source is best suited?

  1. An nmap SYN scan of the target's netblock
  2. The target's HTTP response headers
  3. A passive DNS database that stores historical resolution records Correct answer.
  4. The current authoritative zone file of the target

Explanation

Passive DNS providers collect and retain resolution data observed from recursive resolvers over time, so they can return hostnames and IPs that have since changed or been removed. This makes them the right source for historical mappings during passive OSINT.

Question 28Open-Source Intelligence (OSINT) reconnaissance

An analyst finds a target employee's public profile listing a personal blog domain. Which OSINT step best extends the investigation of that individual while remaining passive?

  1. Send a crafted email to the blog's contact address to test for a bounce
  2. Attempt default credentials on the blog's administrative login
  3. Query the blog's WHOIS history and certificate records for related domains Correct answer.
  4. Run a full port scan against the blog's hosting IP

Explanation

WHOIS history and certificate transparency data are already published records, so reviewing them for the personal domain stays passive while potentially linking the individual to other infrastructure. The other choices interact directly with the target's systems.

Question 29Open-Source Intelligence (OSINT) reconnaissance

Which Google dork operator combination best finds documents hosted on a target site that are indexed as PDFs?

  1. inurl:target.com intitle:pdf
  2. site:target.com filetype:pdf Correct answer.
  3. cache:target.com pdf
  4. link:target.com ext:pdf

Explanation

The site: operator restricts results to a domain and filetype: filters by file extension, so combining them returns indexed PDFs on the target site. This is the standard dork pattern for document discovery.

Question 30Open-Source Intelligence (OSINT) reconnaissance

An analyst reviewing a target's web application finds an API endpoint that returns employee records without authentication when called with a valid tenant identifier. What is the correct OSINT interpretation?

  1. A honeypot that must be attacked to confirm its purpose
  2. A DNS misconfiguration unrelated to the application
  3. A normal design pattern that requires no further action
  4. A data exposure finding that should be documented with request evidence and reported responsibly Correct answer.

Explanation

Unauthenticated access to sensitive records is an exposure, and the analyst's job is to capture reproducible evidence such as the request, response, and timestamp, then report it through the agreed channel. OSINT collection should not escalate into exploitation beyond what is authorized.

Question 31Open-Source Intelligence (OSINT) reconnaissance

An analyst wants to identify technologies and versions exposed by a target's public web server without sending packets to it. Which approach fits?

  1. Send HTTP OPTIONS requests to each virtual host
  2. Review cached Shodan or Censys records for the host's IP Correct answer.
  3. Fingerprint the server with nmap service detection
  4. Brute force common paths with a directory tool

Explanation

Shodan and Censys continuously scan the internet and publish banners, so querying their existing records for the host's IP yields technology and version data without the analyst contacting the target. That keeps the activity passive.

Question 32Open-Source Intelligence (OSINT) reconnaissance

An analyst discovers the target's main website is hosted with a CDN but a legacy application subdomain resolves directly to an origin IP. Why does this matter for OSINT?

  1. The origin IP may expose services that the CDN was shielding from direct access Correct answer.
  2. The CDN will automatically block all reconnaissance queries
  3. The origin IP is always a private RFC 1918 address
  4. The subdomain cannot be enumerated without active scanning

Explanation

When a hostname bypasses the CDN and points at the origin, the protections applied at the edge no longer cover it, so the origin may reveal additional services and banners. Identifying such bypasses is a core part of mapping the real attack surface.

Question 33Open-Source Intelligence (OSINT) reconnaissance

Which artifact from a public code repository most reliably reveals a developer's internal naming conventions and project structure?

  1. The repository's license file
  2. The repository's issue templates
  3. Commit history and directory layout of public repositories Correct answer.
  4. The number of stars on the repository

Explanation

Commit history and directory structure expose how an organization names projects, branches, and internal services, which can inform later targeting and dorking. Licensing, stars, and templates carry little structural intelligence.

Question 34Open-Source Intelligence (OSINT) reconnaissance

An analyst needs to map a target organization's email naming convention to build a realistic phishing-awareness test list. Which passive method is most defensible?

  1. Infer the pattern from publicly posted addresses and verify deliverability only with authorization Correct answer.
  2. Guess addresses and send test messages to each to see which bounce
  3. Scrape the target's internal directory through an open share
  4. Enumerate the mail server with SMTP VRFY against the target

Explanation

Publicly posted addresses reveal the naming pattern, and any deliverability validation must be covered by explicit authorization because it contacts the target's mail infrastructure. Inference from published data keeps the collection passive.

Question 35Open-Source Intelligence (OSINT) reconnaissance

An analyst is profiling a target's physical security posture from open sources. Which collection is most appropriate?

  1. Attempts to tailgate employees through the lobby
  2. Calls to the reception desk to confirm shift changes
  3. Satellite imagery and publicly posted photos of the facility entrances Correct answer.
  4. A drive-by of the facility to photograph badge readers

Explanation

Satellite imagery and photos published by the organization or its visitors are open sources that reveal entrances, parking, and layout without any interaction. Physical presence or social engineering moves the activity into active HUMINT territory.

Question 36Open-Source Intelligence (OSINT) reconnaissance

An analyst finds a target's internal wiki page indexed by a search engine containing architecture diagrams. What is the most significant OSINT implication?

  1. The wiki must be hosted on a CDN
  2. Internal design details and technology choices are exposed to anyone, informing later attack paths Correct answer.
  3. The search engine has been compromised
  4. The diagrams are automatically encrypted

Explanation

Indexed internal documentation leaks architecture, naming, and technology decisions that help an attacker prioritize targets and craft convincing pretexts. The exposure itself is the finding, regardless of hosting details.

Question 37Open-Source Intelligence (OSINT) reconnaissance

An analyst wants to correlate a target's infrastructure over time and needs to avoid alerting the target. Which collection discipline should guide the plan?

  1. Alternate between scanning and passive sources to cross-check
  2. Use only social media because it is always passive
  3. Rely on third-party cached and historical datasets and avoid direct packets to target-owned hosts Correct answer.
  4. Prefer direct scanning because it produces fresher data

Explanation

Passive collection uses data others already gathered, such as search engine caches, passive DNS, and scan archives, so the target sees no traffic from the analyst. Direct scanning generates logs and alerts, breaking the no-alert requirement.

Question 38Open-Source Intelligence (OSINT) reconnaissance

Which technique best links a target's mobile application to backend infrastructure during passive OSINT?

  1. Installing the app on a device and probing its endpoints
  2. Intercepting live traffic between the app and its servers
  3. Extracting API hostnames and keys from the published app package Correct answer.
  4. Running a man-in-the-middle proxy against the app

Explanation

Published app packages often contain embedded hostnames, API keys, and configuration that reveal backend services without any interaction with the target. Traffic interception and endpoint probing are active techniques that require authorization.

Question 39Open-Source Intelligence (OSINT) reconnaissance

An analyst wants to verify whether a leaked credential pair is real without locking the account. Which approach is most appropriate?

  1. Try the credential against several related services
  2. Reset the account password to test the email address
  3. Check the credential against a breach aggregation service rather than the live login Correct answer.
  4. Attempt the login once on the target's production portal

Explanation

Breach aggregation services let the analyst confirm whether a credential appears in known leaks without touching the target's authentication system. Any live login attempt risks lockout, alerts, and unauthorized access.

Question 40Open-Source Intelligence (OSINT) reconnaissance

An analyst is building a timeline of a target's infrastructure changes from domain registration to current hosting. Which combination of records gives the most reliable chronology?

  1. The target's current homepage copyright year
  2. The file modification times on the target's web server
  3. Social media post counts over the last year
  4. WHOIS creation and update dates paired with passive DNS first-seen timestamps Correct answer.

Explanation

WHOIS creation and update dates anchor domain events, and passive DNS first-seen and last-seen timestamps anchor hosting changes, so together they produce a defensible chronology. The other sources are indirect or inaccessible.

Question 41Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

During an internal penetration test, you obtain an unprivileged domain user's cleartext password. Which technique lets you enumerate domain resources without sending authentication traffic that could trigger lockout or detection of the user's account?

  1. Running LDAP queries anonymously against the Domain Controller
  2. Requesting a Kerberos TGT and using pass-the-ticket for subsequent access Correct answer.
  3. Password spraying the account against every host in the domain
  4. Deriving the account's NTLM hash and using pass-the-hash for LDAP binds

Explanation

Requesting a TGT once and then presenting the ticket (pass-the-ticket) avoids repeated credential authentication and does not increment bad-password counters, so it is safer than spraying. It also keeps the cleartext password off the wire during later access. Pass-the-hash against LDAP is unreliable because LDAP simple/NTLM bind behavior varies and hashes cannot be used for Kerberos pre-auth directly.

Question 42Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

You have local administrator on a workstation but not domain rights. Which artifact most directly allows you to recover cached domain credential material from that host for offline use?

  1. The SAM hive containing local account password hashes
  2. The SECURITY hive containing the LSA secrets and cached domain logon verifiers Correct answer.
  3. The NTDS.dit file on the local disk
  4. The SYSTEM hive containing the machine account password

Explanation

Cached domain logon information (MSCache/DCC2) lives in the SECURITY hive and can be extracted and cracked offline once you have local admin. The SAM hive only holds local account hashes, which do not yield domain credentials. NTDS.dit is only present on Domain Controllers.

Question 43Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

An assessment requires you to move laterally to a server whose SMB service is blocked by host firewall rules, but WinRM over 5985 is reachable. Which built-in Windows mechanism best supports remote command execution in this scenario?

  1. Scheduled tasks created via SMB
  2. WMI over DCOM on port 135
  3. PsExec over SMB named pipes
  4. WinRM using PowerShell Remoting Correct answer.

Explanation

PowerShell Remoting uses the WinRM service over TCP 5985 (HTTP) or 5986 (HTTPS), so it works when SMB is blocked but WinRM is allowed. PsExec, SMB scheduled tasks, and WMI/DCOM all rely on ports that are blocked in this scenario.

Question 44Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

You compromise a workstation and want to escalate to domain admin by abusing a misconfigured Group Policy Object. Which condition makes the GPO exploitable for this purpose?

  1. The GPO is enforced and cannot be overridden
  2. The GPO is disabled but still present in SYSVOL
  3. The GPO is linked only to the Domain Controllers OU
  4. A principal you control has write access to the GPO or its SYSVOL contents Correct answer.

Explanation

If your controlled principal can modify a GPO, you can push malicious settings (such as a scheduled task or local admin addition) to every computer the GPO applies to. Enforcement or link location affects scope but does not by itself grant the write access needed. The exploitable weakness is the ACL granting modification rights.

Question 45Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

During internal enumeration you find a service account with a Service Principal Name and no pre-authentication requirement. Which attack is enabled by the missing pre-authentication?

  1. Skeleton key implantation on the Domain Controller
  2. Kerberoasting the service account
  3. Silver ticket forgery against the service
  4. AS-REP roasting to obtain an offline-crackable encrypted blob Correct answer.

Explanation

Accounts without Kerberos pre-authentication allow an unauthenticated AS-REQ, and the KDC returns an AS-REP encrypted with the user's key that can be cracked offline. Kerberoasting requires a service ticket (TGS) and does not depend on pre-auth settings. Silver tickets and skeleton keys require prior compromise of keys or the DC.

Question 46Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

You have domain user credentials and want to enumerate Active Directory objects and ACLs from a Linux attack host without installing extra tools. Which approach best accomplishes this?

  1. Requesting a service ticket for the LDAP SPN
  2. Sending SMB null sessions to the Domain Controller
  3. Running BloodHound's SharpHound collector directly from Linux
  4. Querying LDAP on port 389 with the authenticated user's credentials Correct answer.

Explanation

An authenticated LDAP bind to port 389 (or 636 for LDAPS) lets you read directory objects and ACLs using the user's credentials. Null sessions are disabled by default in modern domains, SharpHound is a .NET collector, and requesting a ticket alone does not return directory data.

Question 47Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

A host you control is on a segmented VLAN that blocks all outbound traffic except DNS to the internal resolver. Which egress technique is most likely to succeed for exfiltrating data to your external server?

  1. Sending ICMP echo requests with embedded payloads
  2. Tunneling SMB over the allowed DNS channel
  3. Encoding data in DNS queries to a domain you control Correct answer.
  4. Reverse shell over TCP 443 to the external server

Explanation

When only DNS is permitted, encoding data in DNS queries to an authoritative domain you control lets the data leave through the resolver. TCP 443 and ICMP are blocked by the segmentation policy. SMB tunneling over DNS is not a standard or reliable channel.

Question 48Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

You have obtained a Kerberos TGS ticket for a service account and want to crack it offline. Which property of the ticket makes it crackable?

  1. It is encrypted with the krbtgt account's key
  2. It is encrypted with the requesting user's password hash
  3. It is encrypted with the service account's long-term key Correct answer.
  4. It is signed with the Domain Controller's machine account key

Explanation

A service ticket's encrypted portion is protected with the service account's long-term key, so an attacker can attempt an offline dictionary or brute-force attack against that key. The krbtgt key protects TGTs, not service tickets. The requesting user's hash does not encrypt the service ticket.

Question 49Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

You are on a compromised workstation and want to identify domain accounts with a path to Domain Admin using graph analysis. Which data source and tool combination is appropriate?

  1. BloodHound data collected with SharpHound and queried for attack paths Correct answer.
  2. Netstat output parsed with BloodHound
  3. Event logs from the workstation analyzed with Mimikatz
  4. Nmap service scan results imported into Metasploit

Explanation

SharpHound collects directory relationships and ACL data, and BloodHound analyzes that graph to reveal paths to privileged groups. Nmap, netstat, and local event logs do not capture domain ACL relationships. The combination of collector and graph tool is the standard approach.

Question 50Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)

A domain controller is reachable, and you have valid domain admin credentials. Which technique allows you to obtain the krbtgt hash for forging golden tickets?

  1. DCSync replication of the krbtgt secrets Correct answer.
  2. Kerberoasting the krbtgt account
  3. Silver ticket request for the krbtgt SPN
  4. AS-REP roasting the krbtgt account

Explanation

DCSync uses directory replication rights to request the krbtgt account secrets from a Domain Controller, yielding the hash needed for golden tickets. krbtgt has no SPN to roast, and silver tickets require an existing service key rather than producing the krbtgt hash.