After a penetration test on the internal network the following report was generated: Which of the following should be recommended to remediate the attack?

The correct answer is C. Rotating KRBTGT password. The KRBTGT account is a critical account used by the Kerberos authentication protocol. The fact that the hash for KRBTGT.CORP.LOCAL was successfully collected during the attack indicates that the attacker may have gained access to Kerberos tickets and could potentially impersonat

Submitted by olafpl· Mar 6, 2026Security Operations

Question

After a penetration test on the internal network the following report was generated:

Which of the following should be recommended to remediate the attack?

Exhibits

Options

ADeleting SQLSV
BReimaging ADMIN01$
CRotating KRBTGT password
DResetting the local domain

How the community answered

(45 responses)

A
2% (1)
B
4% (2)
C
82% (37)
D
11% (5)

Explanation

The KRBTGT account is a critical account used by the Kerberos authentication protocol. The fact that the hash for KRBTGT.CORP.LOCAL was successfully collected during the attack indicates that the attacker may have gained access to Kerberos tickets and could potentially impersonate users. Rotating the KRBTGT password helps mitigate the risk of Kerberos ticket forging, which is a common post-exploitation technique in attacks such as Pass-the-Ticket and Golden Ticket attacks. This will prevent attackers from using stolen hashes to impersonate users or gain unauthorized access to the domain.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice