QCM : Active Directory Exploitation Techniques — 11 questions

Questions et réponses du QCM

1. What is Active Directory in a Windows enterprise environment?

A backup database that stores only Group Policy scripts
A packet-filtering protocol used to control inbound and outbound traffic
A local file system used to store user profiles on each workstation
A directory service that centralizes management and provides authentication and authorization

A directory service that centralizes management and provides authentication and authorization

Explication

Active Directory is the directory service that centralizes identity and access management in Windows networks. It provides authentication, authorization, and other directory functions.

2. What is Active Directory primarily used for in Windows enterprise environments?

A directory service that centralizes management and provides authentication and authorization functions
A database for storing user emails and contacts
A directory service that manages network hardware
A protocol for file sharing between Windows systems

A directory service that centralizes management and provides authentication and authorization functions

Explication

Active Directory is a directory service that centralizes management and provides authentication, authorization, and related directory functions within Windows enterprise environments.

3. What does NTDS.DIT store on a domain controller?

Encrypted web session cookies for domain users
Directory information for users and services
Cached TGTs for delegated servers
Firewall rules and network connection logs

Directory information for users and services

Explication

NTDS.DIT is the Active Directory database file stored by domain controllers and contains directory information. The other options describe unrelated data sources.

4. What is the primary function of Active Directory in Windows enterprise environments?

To centralize management and provide authentication and authorization services
To serve as a backup system for Windows servers
To manage network hardware configurations and firmware updates
To store user emails and facilitate email communication

To centralize management and provide authentication and authorization services

Explication

Active Directory centralizes management and provides authentication, authorization, and directory services in Windows enterprise environments, making it the core identity and access management system.

5. What condition must be present for AS-REP roasting to work against a user account?

The account must be a member of the Protected Users group
The account must be a local administrator on the target host
Kerberos preauthentication must be disabled for the account
The account must have an SPN registered in Active Directory

Kerberos preauthentication must be disabled for the account

Explication

AS-REP roasting targets accounts where Kerberos preauthentication is disabled, allowing an AS-REP to be obtained without proving knowledge of the password first. That makes the response material crackable offline.

6. What is the main purpose of Kerberoasting in a cybersecurity attack?

To escalate privileges by exploiting vulnerabilities in the Kerberos protocol.
To extract and crack service account passwords from service tickets encrypted with NTLM hashes.
To disable Kerberos authentication by flooding the ticket granting service.
To intercept user credentials during the initial login process.

To extract and crack service account passwords from service tickets encrypted with NTLM hashes.

Explication

Kerberoasting aims to obtain service tickets encrypted with service account hashes, which can be cracked offline to reveal passwords, enabling further malicious activities.

7. How should an exported AS-REP roastable hash be prepared for hashcat recognition?

Append the domain SID to the end of the hash
Add 23$ immediately after the $krb5asrep$ tag
Convert the hash to base64 before cracking
Replace the $krb5asrep$ tag with $krbtgt$

Add 23$ immediately after the $krb5asrep$ tag

Explication

For hashcat recognition, the exported hash needs 23$ inserted immediately after the $krb5asrep$ tag. The other choices do not match the required hash format.

8. When was the concept of Group Policy Object (GPO) abuse and detection first formally documented as a security concern in Active Directory environments?

In the early 2000s with Windows Server 2003
With the introduction of PrinterBug in 2018
During the initial release of Active Directory in 2000
In the 2014 security update KB2962486

During the initial release of Active Directory in 2000

Explication

GPO abuse and detection became a recognized security concern with the initial deployment of Active Directory, which was released in 2000, as organizations began to realize the potential for GPO modifications to be exploited.

9. How does a DCSync attack differ from normal Domain Controller replication in Active Directory?

DCSync uses LDAP protocol exclusively, whereas normal replication uses RPC.
DCSync is a method to update Active Directory data, while normal replication is used for data backup.
A DCSync attack involves physical access to a Domain Controller, while normal replication is purely network-based.
A DCSync attack impersonates a Domain Controller to request directory changes, whereas normal replication involves authorized Domain Controllers sharing data.

A DCSync attack impersonates a Domain Controller to request directory changes, whereas normal replication involves authorized Domain Controllers sharing data.

Explication

A DCSync attack impersonates a Domain Controller to trigger replication and extract password hashes, which is unauthorized, unlike legitimate Domain Controller replication that is authorized and controlled.

10. Who is credited with proposing the concept of Golden Ticket attacks in Active Directory security?

Kevin Mitnick
Sean Metcalf
Lee Christensen
Benjamin Delpy

Benjamin Delpy

Explication

Benjamin Delpy, through his work with Mimikatz, is credited with popularizing the concept of Golden Ticket attacks, which involve forging Kerberos tickets to impersonate privileged users.

11. What is the primary consequence of a Golden Ticket attack on an Active Directory environment?

It allows an attacker to impersonate any user, including administrators, by forging Kerberos tickets.
It automatically resets all user passwords in the domain.
It enables attackers to decrypt all encrypted traffic within the network.
It causes the domain controller to crash, disrupting authentication services.

It allows an attacker to impersonate any user, including administrators, by forging Kerberos tickets.

Explication

A Golden Ticket attack allows an attacker to forge Kerberos tickets, impersonating any user, including privileged accounts, which compromises domain security.

Révisez avec les flashcards

Mémorisez les réponses avec 11 flashcards sur Active Directory Exploitation Techniques.

Active Directory — role?

Centralized management and authentication for Windows networks.

Active Directory Definition

Directory service centralizing management and authentication

AS-REP roasting — purpose?

Extracts crackable hashes from accounts with preauth disabled.

Voir les flashcards →

Approfondir avec la fiche

Consultez la fiche de révision complète sur Active Directory Exploitation Techniques.

Voir la fiche →

Cours similaires

Gestion des fichiers en PHP

Programmation

Identification utilisateur en PHP

Programmation

Automated PCB Fault Diagnosis

Intelligence Artificielle

Rôle d'un système d'exploitation

Questions techniques projet Compawgnon

Bases de Python pour débutants

Programmation

Crée tes propres QCM

Importe ton cours et l'IA génère des QCM avec corrections en 30 secondes.

Générateur de QCM