PenTest+ Lateral Movement and Pivoting Quiz

1. Kerberoasting targets which Kerberos component to extract crackable hashes?

Service Principal Names (SPNs)

Ticket Granting Ticket (TGT)

Key Distribution Center (KDC)

Authentication Server (AS)

Submit

3. Which Windows registry hive contains cached domain credentials that can be extracted post-exploitation?

HKEY_LOCAL_MACHINE\SAM

HKEY_LOCAL_MACHINE\Security

HKEY_CURRENT_USER\Software

HKEY_LOCAL_MACHINE\System

4. True or False: Token impersonation requires the attacker to have SYSTEM-level privileges on the compromised host.

True

False

5. What is the primary purpose of using a SOCKS proxy during lateral movement?

To mask the attacker's original IP address

To tunnel traffic through a compromised host

To increase attack speed

To bypass all encryption

Submit

7. Which of the following are effective methods for network reconnaissance from a compromised host? (Select all that apply)

ARP scanning to identify local hosts

Port scanning with netstat or nmap

Enumerating network shares and SMB services

Directly accessing the internet backbone

Submit

8. True or False: Constrained delegation allows a service to impersonate users for specific services only.

True

False

9. Which tool is used to create a golden ticket after compromising the krbtgt hash?

Hashcat

Mimikatz

Responder

BloodHound

Submit

11. What is the primary goal of lateral movement in a post-exploitation phase?

Establish persistence on the initial compromised host

Move from one compromised system to other systems on the network

Exfiltrate data directly to an external server

Disable all firewall rules immediately

12. What is the primary advantage of using a reverse proxy for lateral movement?

It increases network bandwidth

It allows traffic tunneling through a compromised host

It encrypts all data automatically

It prevents all antivirus detection

13. True or False: A compromised domain controller provides immediate access to all domain user credentials.

True

False

14. Which Windows service is often exploited for privilege escalation through service modification?

Windows Defender

Unquoted service paths

Windows Update

Task Scheduler

Submit

16. What does the term 'living off the land' refer to in post-exploitation?

Using legitimate system tools to avoid detection

Establishing a physical presence near the target

Using only free open-source hacking tools

Conducting attacks from a remote island

17. Which of the following is a valid method for credential harvesting post-exploitation? (Select all that apply)

Memory scraping from running processes

Extracting hashes from the SAM database

Harvesting credentials from browser caches

Listening on port 443 for unencrypted traffic

Submit

18. True or False: Kerberos golden tickets can be used to impersonate any user on a domain after compromising the krbtgt account.

True

False

Submit

20. Which technique allows an attacker to use a compromised host as a gateway to access other network segments?

Pivoting

Phishing

Brute forcing

SQL injection

PenTest+ Lateral Movement and Pivoting Concepts Quiz

1. Kerberoasting targets which Kerberos component to extract crackable hashes?

2.

What first name or nickname would you like us to use?

2. BloodHound is used post-exploitation to map ____ relationships and identify privilege escalation paths.

3. Which Windows registry hive contains cached domain credentials that can be extracted post-exploitation?

4. True or False: Token impersonation requires the attacker to have SYSTEM-level privileges on the compromised host.

5. What is the primary purpose of using a SOCKS proxy during lateral movement?

6. A ____ is a user account with administrative privileges created for persistence after exploitation.

7. Which of the following are effective methods for network reconnaissance from a compromised host? (Select all that apply)

8. True or False: Constrained delegation allows a service to impersonate users for specific services only.

9. Which tool is used to create a golden ticket after compromising the krbtgt hash?

10. In Active Directory, the ____ attribute can be modified to enable privileged delegation.

11. What is the primary goal of lateral movement in a post-exploitation phase?

12. What is the primary advantage of using a reverse proxy for lateral movement?

13. True or False: A compromised domain controller provides immediate access to all domain user credentials.

14. Which Windows service is often exploited for privilege escalation through service modification?

15. Mimikatz is commonly used post-exploitation to extract ____ from Windows systems.

16. What does the term 'living off the land' refer to in post-exploitation?

17. Which of the following is a valid method for credential harvesting post-exploitation? (Select all that apply)

18. True or False: Kerberos golden tickets can be used to impersonate any user on a domain after compromising the krbtgt account.

19. Pass-the-hash attacks are effective because they allow attackers to authenticate without knowing the user's ____.

20. Which technique allows an attacker to use a compromised host as a gateway to access other network segments?