OSCP Active Directory Enumeration

1. In LDAP enumeration, what does the base DN (Distinguished Name) represent?

The root starting point for directory queries

The database name on the server

The encryption algorithm used

The backup domain name

2. In AD enumeration, what does identifying 'nested group membership' help accomplish?

Discover indirect privilege escalation paths

Measure network bandwidth usage

Identify DNS resolution issues

Audit file access logs

3. What information does the 'lastLogon' attribute provide in AD?

Timestamp of the user's most recent successful logon

List of all previous logon attempts

IP address of the login source

Duration of the user's session

4. Which tool collects AD data and injects it into Bloodhound for analysis?

SharpHound

Mimikatz

Kerbrute

Responder

5. What does the 'servicePrincipalName' (SPN) attribute reveal in AD enumeration?

Services registered for Kerberos authentication

The user's email service provider

Active VPN connections

Installed antivirus software

6. Which attribute identifies users who have never changed their password?

PwdLastSet

LastLogon

AccountExpires

BadPwdCount

7. Which LDAP filter syntax is used to query all user objects in Active Directory?

(objectClass=user)

(objectClass=person)

(objectClass=group)

(objectClass=computer)

8. What does the 'userAccountControl' attribute in AD indicate?

Account status flags and properties

Number of failed login attempts

User's department assignment

User's email address

9. What information can be gathered from the 'description' field in AD user objects?

User's job title or role hints

User's encrypted password

User's SSH public key

User's VPN credentials

10. What is the primary purpose of enumerating AD trust relationships?

To identify cross-domain attack vectors

To measure network latency

To check DNS resolution

To audit firewall logs

11. Which tool is used to visualize Active Directory relationships and potential attack paths?

Nmap

Bloodhound

Wireshark

Metasploit

12. In Active Directory, what does the 'memberOf' attribute reveal?

Groups a user or computer belongs to

The user's last login timestamp

The user's password hash

Shared resources accessible to the user

13. Which PowerShell cmdlet is commonly used to enumerate AD users and their properties?

Get-ADUser

Get-ADComputer

Get-ADGroup

Get-ADForest

14. What does the ldapsearch tool primarily enumerate from AD?

Network traffic and packet flows

Directory objects, attributes, and schema information

Operating system vulnerabilities

Firewall rules and ACLs

15. Which PowerShell command lists all domain controllers in the current forest?

Get-ADDomainController

Get-ADForestSchema

Get-ADRootDSE

Get-ADDomain

16. Which LDAP attribute stores the user's primary group ID?

PrimaryGroupID

GroupId

UserPrimaryGroup

ObjectSID

17. What can be inferred from enumerating users with 'userAccountControl' flag 66048?

Account is enabled and a workstation trust account

Account is disabled and locked

Account has admin privileges

Account is a service account

18. Which command reveals the functional level of an Active Directory domain?

Get-ADDomain | Select DomainMode

Get-ADComputer -Filter *

Get-ADUser -Filter *

Get-ADGroup -Filter *

19. What does enumerating the 'adminCount' attribute help identify?

Objects that have held administrative privileges

The number of admins in the domain

Accounts currently logged in as admin

The admin password complexity requirements

20. Which LDAP search scope returns only direct children of the base DN?

Onelevel

Subtree

Base

Subordinate

OSCP Active Directory Enumeration Quiz