PT0-001 · Question #82
An assessor begins an internal security test of the Windows domain internal. comptinet. The assessor is given network access via DHCP, but is not given any network maps or target IP addresses. Which…
The correct answer is A. dig -q any _kerberos._tcp.internal.comptia.net. Active Directory domain controllers register Kerberos SRV records in DNS, making them discoverable via DNS queries without prior knowledge of IP addresses or network maps.
Question
An assessor begins an internal security test of the Windows domain internal. comptinet. The assessor is given network access via DHCP, but is not given any network maps or target IP addresses. Which of the following commands can the assessor use to find any likely Windows domain controllers?
Options
- Adig -q any _kerberos._tcp.internal.comptia.net
- Bdig -q any _lanman._tcp.internal.comptia.net
- Cdig -q any _ntlm._tcp.internal.comptia.net
- Ddig -q any _smtp._tcp.internal.comptia.net
How the community answered
(39 responses)- A72% (28)
- B15% (6)
- C10% (4)
- D3% (1)
Why each option
Active Directory domain controllers register Kerberos SRV records in DNS, making them discoverable via DNS queries without prior knowledge of IP addresses or network maps.
Windows domain controllers automatically register _kerberos._tcp SRV records in DNS as part of the Active Directory DC locator mechanism. Querying this SRV record returns the hostnames and IP addresses of domain controllers, allowing discovery with no prior network knowledge beyond the domain name.
_lanman._tcp is not a recognized DNS SRV record type used by Active Directory for domain controller registration or discovery.
NTLM authentication is a challenge-response protocol that does not rely on DNS SRV records for service or domain controller location.
_smtp._tcp is a DNS SRV record used for locating mail transfer agents, not Windows domain controllers.
Concept tested: DNS SRV records for Active Directory DC location
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/how-dns-support-active-directory
Topics
Community Discussion
No community discussion yet for this question.