Active Directory Penetration Testing Skills

1. What is the primary advantage of using Silver Tickets over Golden Tickets?

Easier to detect

Requires service account hash only

Longer validity period

Works across all domains

2. Which post-exploitation technique allows persistent access using AD credentials?

Creating backdoor accounts

Modifying group policies

Establishing hidden shares

All of the above

3. What is the primary benefit of using constrained delegation in AD?

Increases authentication speed

Limits impersonation to specific services

Encrypts all traffic

Removes password requirements

4. Which credential is most critical to protect to prevent Golden Ticket attacks?

Administrator password

KRBTGT account hash

Domain admin credentials

Service account passwords

5. What does the 'across forest' attack path in AD exploitation refer to?

Moving between domains in same forest

Moving between separate AD forests

Lateral movement within a domain

Privilege escalation on workstations

6. Which technique involves capturing NTLM hashes by forcing authentication to an attacker-controlled system?

Brute forcing

Hash poisoning

Credential harvesting

SMB relay

7. What is the primary risk of overly permissive AD permissions?

Performance degradation

Privilege escalation opportunities

Network slowdowns

Backup failures

8. Which authentication method is vulnerable to password spraying attacks?

Kerberos only

NTLM only

Both Kerberos and NTLM

Neither

9. What does DCSync attack allow an attacker to do?

Dump all AD password hashes

Lock all domain accounts

Delete domain controllers

Modify domain policies

10. Which tool is used to visualize AD relationships and identify attack paths?

Responder

BloodHound

Hashcat

John the Ripper

11. Which tool is primarily used for enumerating Active Directory users and groups from an unauthenticated perspective?

BloodHound

Responder

Impacket

Mimikatz

12. Which attack involves capturing and replaying NTLM authentication exchanges?

Pass-the-hash

NTLM relay

Credential spraying

Dictionary attack

13. What does the LDAP protocol primarily do in Active Directory?

Authenticates users

Queries and modifies directory objects

Encrypts network traffic

Manages group policies

14. Which AD vulnerability allows attackers to escalate privileges through delegation abuse?

Unconstrained delegation

Constrained delegation

Resource-based constrained delegation

All of the above

15. What information is required to perform a Golden Ticket attack?

KRBTGT hash only

Domain SID and KRBTGT hash

User password

Domain admin credentials

16. Golden Ticket attacks allow attackers to forge tickets for which service?

Any service in the domain

Only file shares

Only workstations

Only domain controllers

17. Which Impacket tool is commonly used to perform NTLM relay attacks?

Ntlmrelayx.py

Secretsdump.py

Psexec.py

Wmiexec.py

18. What is the primary purpose of a Kerberoasting attack?

Steal TGT tickets

Extract service account credentials

Bypass MFA

Enumerate domain structure

19. Which protocol is used by AD for authentication and is a primary target for penetration testing?

LDAP

Kerberos

NTLM

All of the above

20. What does ASREP roasting attack exploit in Active Directory?

Kerberos pre-authentication disabled

Weak password policies

Unpatched domain controllers

Misconfigured SPNs

CPENT Active Directory Penetration Testing Quiz

1. What is the primary advantage of using Silver Tickets over Golden Tickets?

2.

What first name or nickname would you like us to use?

2. Which post-exploitation technique allows persistent access using AD credentials?

3. What is the primary benefit of using constrained delegation in AD?

4. Which credential is most critical to protect to prevent Golden Ticket attacks?

5. What does the 'across forest' attack path in AD exploitation refer to?

6. Which technique involves capturing NTLM hashes by forcing authentication to an attacker-controlled system?

7. What is the primary risk of overly permissive AD permissions?

8. Which authentication method is vulnerable to password spraying attacks?

9. What does DCSync attack allow an attacker to do?

10. Which tool is used to visualize AD relationships and identify attack paths?

11. Which tool is primarily used for enumerating Active Directory users and groups from an unauthenticated perspective?

12. Which attack involves capturing and replaying NTLM authentication exchanges?

13. What does the LDAP protocol primarily do in Active Directory?

14. Which AD vulnerability allows attackers to escalate privileges through delegation abuse?

15. What information is required to perform a Golden Ticket attack?

16. Golden Ticket attacks allow attackers to forge tickets for which service?

17. Which Impacket tool is commonly used to perform NTLM relay attacks?

18. What is the primary purpose of a Kerberoasting attack?

19. Which protocol is used by AD for authentication and is a primary target for penetration testing?

20. What does ASREP roasting attack exploit in Active Directory?