Privilege Escalation & Lateral Movement Quiz

1. In the context of lateral movement, what is a Kerberos Golden Ticket?

A forged authentication ticket granting access to multiple systems

A legitimate domain admin ticket

A temporary guest access token

A certificate used for SSL/TLS connections

2. Which post-exploitation technique involves creating a backdoor account with hidden privileges?

Privilege escalation

Credential dumping

Persistence mechanism

Lateral movement

3. What is a potential risk of storing credentials in environment variables or configuration files?

They become harder to access

They are easily discovered during post-exploitation

They are automatically encrypted

They expire more quickly

4. In Linux, which command allows a user to execute commands with elevated privileges if properly configured?

Su

Sudo

Chmod

Chown

5. What is the purpose of using Mimikatz in post-exploitation scenarios?

To scan network vulnerabilities

To extract credentials and authentication tickets from memory

To perform port scanning

To enumerate file systems

6. Which technique involves injecting malicious code into a running process to avoid detection?

DLL injection

Registry injection

Kernel injection

File injection

7. In Windows Active Directory, what does a Silver Ticket allow an attacker to do?

Access any resource in the entire domain

Forge tickets for specific services without domain admin privileges

Bypass all authentication mechanisms

Modify the domain controller directly

8. What is the primary advantage of using SSH keys for lateral movement in Linux environments?

They are easier to crack than passwords

They allow password-less authentication to remote systems

They are stored in plaintext by default

They bypass firewall rules

9. Which persistence technique involves modifying the Windows Registry to execute code at startup?

Scheduled tasks

Run/RunOnce keys

Startup folder modification

Service creation

10. What is the purpose of establishing persistence during post-exploitation?

To maintain long-term access even after system reboots

To delete forensic evidence

To encrypt all system files

To disable all security software

11. What is the primary goal of privilege escalation in a post-exploitation scenario?

Gain administrative or higher-level access on a compromised system

Install antivirus software

Create new user accounts

Delete system logs

12. Which Linux privilege escalation vector involves misconfigured SUID binaries?

Kernel exploits

Sudo misconfigurations

Exploiting binaries with execute permissions set for all users

Weak file permissions on cron jobs

13. What is Pass-the-Hash (PtH) in Windows post-exploitation?

Using a captured NTLM hash to authenticate without knowing the plaintext password

Creating a hash of a stolen password

Modifying hash values in memory

Exporting hashes to a file

14. Which Windows credential storage mechanism can be exploited to retrieve plaintext passwords?

LSASS (Local Security Authority Subsystem)

SAM database

Credential Manager

All of the above

15. In lateral movement, what is the primary purpose of credential harvesting?

To identify weak passwords

To obtain valid credentials for accessing other systems on the network

To trigger security alerts

To document user behavior

16. What does UAC (User Account Control) prevent by default on Windows systems?

Remote desktop connections

Non-administrator applications from making system-level changes

Network file sharing

Software installation

17. Which tool is commonly used to enumerate Windows privileges and identify escalation paths?

BloodHound

WinPEAS

LinEnum

Nmap

18. What is token impersonation in the context of Windows privilege escalation?

Creating fake authentication tokens

Using an existing user's token to execute commands with their privileges

Stealing login credentials from memory

Bypassing NTLM authentication

19. In Linux systems, which file typically contains stored password hashes?

/etc/passwd

/etc/shadow

/root/.ssh/id_rsa

/var/log/auth.log

20. Which Windows privilege escalation technique exploits the fact that certain services run with SYSTEM privileges and allow DLL injection?

Token impersonation

DLL hijacking

UAC bypass

Registry modification

PenTest+ Privilege Escalation Techniques Overview Quiz