CompTIA CySA+ Practice Test

If an attacker gains administrative access to an Active Directory environment, which type of attack are they implementing?

1. Pass the hash

2. Lateral movement

3. Pivoting

4. Golden ticket

The correct answer is: Golden ticket

When an attacker gains administrative access to an Active Directory environment, they are implementing a Golden ticket attack. This attack involves the creation of forged Kerberos tickets, which allows the attacker to gain unauthorized access to network resources, impersonate any user, and maintain persistence within the network. By leveraging the administrative access, the attacker can create a ticket-granting ticket (TGT) that is valid for any principal in the Active Directory. This enables them to access sensitive information and services without triggering security alerts, as they appear as a legitimate user within the network. The ability to manipulate these tickets is one of the key advantages of having administrative access, making the Golden ticket a highly effective and stealthy method of attack. In contrast, the other options pertain to different attack strategies that, while serious threats in their own right, do not specifically relate to the scenario of having gained administrative access directly in the context of Active Directory.