Kerberoasting and AD Attack Concepts

1. Silver Ticket attacks differ from Golden Tickets by targeting which account?

The KRBTGT account

A specific service account

The local administrator account

The domain guest account

2. What is a primary advantage of using Managed Service Accounts (MSA) in AD?

Passwords are automatically managed and rotated by the domain

They eliminate the need for the Kerberos protocol

They prevent all AD attacks

They allow unlimited administrative privileges

3. Which mitigation best prevents successful Kerberoasting attacks?

Using strong, randomly generated service account passwords

Disabling all service accounts

Preventing users from logging in

Removing all SPNs from the domain

4. Resource-Based Constrained Delegation (RBCD) allows attacks by modifying which AD attribute?

The msDS-AllowedToDelegateTo attribute

The msDS-AllowedToActOnBehalfOfOtherIdentity attribute

The userAccountControl attribute

The servicePrincipalName attribute

5. Unconstrained Delegation poses a risk because compromised servers can collect which credential type?

Plaintext passwords from users

TGTs from any user who authenticates to the server

NTLM hashes from the SAM database

API keys stored in the registry

6. Constrained Delegation in AD can be exploited to perform which attack?

Privilege escalation by forging tickets for allowed services

Direct denial of service on the KDC

Extraction of NTLM hashes from memory

Modification of group membership policies

7. What is the primary purpose of implementing Service Account Password Management (SAPM)?

Reduce service account reuse and weak password vulnerability

Increase the number of service accounts

Prevent users from logging in remotely

Disable all domain authentication

8. AS-REP Roasting requires which Kerberos setting to be enabled for exploitation?

Preauthentication disabled

Ticket encryption set to RC4

Service Principal Name required

TGT lifetime extended to 24 hours

9. Which attack exploits the fact that user accounts can request service tickets for themselves?

AS-REP Roasting

Kerberoasting

Golden Ticket

NTLM relay

10. Credential stuffing in AD environments typically uses which source of compromised data?

Publicly available password lists and breach databases

The domain controller's registry

Kerberos configuration files

Network packet captures

11. What is the primary objective of a Kerberoasting attack?

Extract and crack service ticket hashes offline

Modify the Kerberos Key Distribution Center

Disable all domain controllers

Intercept all network traffic on the subnet

12. What is the primary benefit of creating a Golden Ticket in an AD environment?

Permanent access even after credential changes

Temporary access for one hour

Access only to file shares

Ability to reset user passwords

13. Golden Ticket attacks target which component of the Kerberos infrastructure?

The Key Distribution Center (KDC)

The domain controller's KRBTGT account

The service account password

The workstation's local security database

14. Pass-the-Ticket (PtT) is an attack that uses stolen Kerberos tickets to do what?

Modify group policies

Impersonate a user or service

Encrypt all domain data

Delete audit logs

15. Which Active Directory enumeration technique identifies accounts with registered SPNs?

LDAP queries

NetBIOS scans

DNS zone transfers

ARP spoofing

16. A Kerberoasting attack requires the attacker to have which minimum level of access?

Domain admin credentials

Local administrator on a workstation

Valid domain user account

Physical access to the server

17. What encryption method does Kerberos typically use for service tickets vulnerable to Kerberoasting?

RC4 (NTLM hash)

AES-256

DES

RSA-2048

18. In Kerberos authentication, which ticket type is targeted during Kerberoasting?

Ticket Granting Ticket (TGT)

Service Ticket (ST)

Session Key

Authentication Token

19. Service Principal Names (SPNs) are required for Kerberoasting because they identify what?

The user who initiated the attack

Services running under domain user accounts

The encryption key for the domain

The IP address of the attacker

20. Which tool is commonly used to perform Kerberoasting attacks?

Mimikatz

Hashcat

Rubeus

Wireshark

PenTest+ V2 Kerberoasting and AD Attack Concepts Quiz