During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?

The correct answer is B. Kerberoasting. Kerberoasting is an attack that specifically targets Service Principal Name (SPN) accounts in a Windows Active Directory environment. Understanding SPN Accounts: SPNs are unique identifiers for services in a network that allows Kerberos to authenticate service accounts. These…

Submitted by cyberguy42· Mar 6, 2026Attacks and Exploits

Question

Options

AGolden Ticket
BKerberoasting
CDCShadow
DLSASS dumping

How the community answered

(51 responses)

A
8% (4)
B
88% (45)
C
2% (1)
D
2% (1)

Explanation

Kerberoasting is an attack that specifically targets Service Principal Name (SPN) accounts in a Windows Active Directory environment. Understanding SPN Accounts: SPNs are unique identifiers for services in a network that allows Kerberos to authenticate service accounts. These accounts are often associated with services such as SQL Server, IIS, etc. Kerberoasting Attack: Prerequisite: Knowledge of the SPN account. Process: An attacker requests a service ticket for the SPN account using the Kerberos protocol. The ticket is encrypted with the service account's NTLM hash. The attacker captures this ticket and attempts to crack the hash offline. Objective: To obtain the plaintext password of the service account, which can then be used for lateral movement or privilege escalation.

Topics

#Active Directory attacks#Kerberoasting#SPN#credential theft

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice