Active Directory Quiz

Q1. Impacket's secretsdump.py is commonly used to:

Enumerate SPNs only Forge silver tickets Remotely dump SAM/LSA secrets and, with rights, domain hashes via DRSUAPI Poison LLMNR

Q2. NTLM relay (e.g., ntlmrelayx) against SMB succeeds when which protection is NOT enforced?

TLS 1.3 SMB signing IPsec DNSSEC

Q3. Forging a Golden Ticket requires the hash/key of which account?

A service account with an SPN Administrator The DC machine account krbtgt

Q4. Microsoft LAPS reduces lateral movement by:

Randomizing and rotating the local Administrator password on each machine Blocking Kerberos Disabling NTLM Encrypting SYSVOL

Q5. Rubeus is a toolkit focused on:

SQL injection Spraying web login forms Kerberos abuse (asktgt, kerberoast, asreproast, s4u, ptt) Web fuzzing

Q6. A DCSync attack abuses directory replication rights to do what?

Ask a DC to replicate account secrets (e.g., krbtgt) as if it were another DC Disable Kerberos domain-wide Reset every user's password Reboot the domain controller

Q7. Which authentication protocol does a modern AD domain prefer for domain logons?

HTTP Basic LDAP simple bind NTLM Kerberos

Q8. A Pass-the-Hash attack authenticates using:

The account's NT hash directly A Kerberos TGT The plaintext password A cracked password only

Q9. A Silver Ticket is a forged ticket for a single service, encrypted with:

The target service (or computer) account's hash The requesting user's NT hash The krbtgt hash The DPAPI master key

Q10. BloodHound is used by attackers primarily to:

Relay NTLM authentication Crack NTLM hashes Map AD relationships and find attack paths (e.g., to Domain Admins) Forge Kerberos tickets

Q11. Running Responder to answer LLMNR/NBT-NS broadcasts primarily lets you capture:

The krbtgt hash NetNTLMv1/v2 challenge-response hashes Kerberos TGTs Plaintext passwords

Q12. Overpass-the-Hash (pass-the-key) uses an NT hash to obtain what, so the attacker can move to Kerberos?

A GPP cpassword A TGS A NetNTLMv2 hash A TGT

Q13. An SPN (Service Principal Name) matters to attackers because it:

Is the Kerberos session key Identifies a service account whose TGS can be requested and Kerberoasted Disables pre-authentication Stores the account password

Q14. DCShadow is a stealthy persistence technique that:

Cracks the krbtgt hash Relays LDAP traffic Deletes the domain controller Registers a rogue domain controller to push attacker-chosen changes via replication

Q15. Why is a computer configured for UNCONSTRAINED delegation dangerous?

It forces an NTLM downgrade It exposes SYSVOL anonymously It caches the TGT of any user who authenticates to it (including a DA), recoverable from LSASS It disables Kerberos