nerdexam
EC-Council

312-50V12 · Question #155

A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for…

The correct answer is D. Invalidate the TGS the attacker acquired. In a Kerberoasting attack, the attacker extracts TGS tickets for offline cracking of service account passwords. The immediate remediation is to invalidate the compromised TGS ticket to prevent its use.

Submitted by packet_pusher· Mar 4, 2026System Hacking Phases and Attack Techniques

Question

A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for offline cracking. But the attacker was stopped before he could complete his attack. The system administrator needs to investigate and remediate the potential breach. What should be the immediate step the system administrator takes?

Options

  • APerform a system reboot to clear the memory
  • BDelete the compromised user's account
  • CChange the NTLM password hash used to encrypt the ST
  • DInvalidate the TGS the attacker acquired

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    12% (3)
  • C
    4% (1)
  • D
    80% (20)

Why each option

In a Kerberoasting attack, the attacker extracts TGS tickets for offline cracking of service account passwords. The immediate remediation is to invalidate the compromised TGS ticket to prevent its use.

APerform a system reboot to clear the memory

A system reboot may clear in-memory tickets on a single host, but the attacker has already exfiltrated the TGS tickets from memory, so rebooting does not invalidate the stolen tickets or prevent their offline cracking.

BDelete the compromised user's account

Deleting the compromised user account is overly destructive and unnecessary at this stage; the TGS was obtained using a valid TGT, but the attacker's goal is to crack service account credentials, not the user's account itself.

CChange the NTLM password hash used to encrypt the ST

Kerberos Service Tickets (ST) are encrypted with the service account's Kerberos key (derived from its password), not an NTLM hash directly; while resetting the service account password is part of remediation, simply changing an NTLM hash does not accurately describe the correct Kerberos ticket invalidation process.

DInvalidate the TGS the attacker acquiredCorrect

Invalidating the TGS ticket the attacker acquired directly addresses the immediate threat by rendering the stolen ticket unusable, which can be accomplished by resetting the service account password (causing re-keying of the service ticket encryption) and purging active Kerberos tickets. This stops the attacker from leveraging any cracked credentials even if offline cracking eventually succeeds, and is the most targeted, least disruptive immediate response to contain the breach.

Concept tested: Kerberoasting attack remediation and TGS ticket invalidation

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/securing-privileged-access

Topics

#Kerberoasting#TGS ticket#Active Directory attacks#incident response

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice