CRTP Practice Test

CRTP practice test: what's covered

• AD Enumeration
• PrivEsc
• Lateral Movement
• Kerberos Attacks
• DCSync
• Golden/Silver/Diamond
• Cross-Trust
• Persistence

Free CRTP sample questions

1. Using PowerView in a CRTP lab, an operator wants to list every user account in the current domain that has a Service Principal Name (SPN) set — the prerequisite for Kerberoasting. Which command returns exactly that set?

   • A. Get-DomainUser -SPN
   • B. Get-DomainUser -PreauthNotRequired
   • C. Get-DomainComputer -Unconstrained
   • D. Get-DomainUser -AdminCount
   Show answer

   Correct: A. Get-DomainUser -SPN filters user objects whose servicePrincipalName attribute is populated, which are the roastable accounts. -PreauthNotRequired finds AS-REP roastable users, -Unconstrained is for delegation on computers, and -AdminCount finds protected/admin-tracked objects.

2. During enumeration you run the PowerView command below. What does the result represent? ``` PS> Get-DomainComputer -TrustedToAuth | Select-Object name,msds-allowedtodelegateto ```

   • A. Computers configured for constrained delegation, listing the services they may delegate to
   • B. Computers configured for unconstrained delegation
   • C. Computers where resource-based constrained delegation is allowed inbound
   • D. Computers that are read-only domain controllers
   Show answer

   Correct: A. -TrustedToAuth matches objects with the TRUSTED_TO_AUTH_FOR_DELEGATION flag (constrained delegation with protocol transition), and msds-allowedtodelegateto holds the allowed target SPNs. Unconstrained uses the TRUSTED_FOR_DELEGATION flag instead, and RBCD is stored on the target's msDS-AllowedToActOnBehalfOfOtherIdentity.

3. An operator wants to enumerate Active Directory using only Microsoft-signed tooling already present on a domain-joined host, to blend in and avoid dropping PowerView. Which option meets that goal?

   • A. The Active Directory PowerShell module (ActiveDirectory / ADModule)
   • B. Mimikatz sekurlsa::logonpasswords
   • C. Rubeus kerberoast
   • D. Invoke-Mimikatz from PowerSploit
   Show answer

   Correct: A. The AD PowerShell module (Get-ADUser, Get-ADComputer, Get-ADTrust, etc.) is Microsoft-signed and can run via the DLL without RSAT install, making it a low-noise enumeration choice. The other tools are offensive credential/Kerberos tools, not pure enumeration.

4. In BloodHound, after collecting data with SharpHound, which built-in analytics query most directly answers 'which principals can reach Domain Admins'?

   • A. Shortest Paths to Domain Admins
   • B. List all Kerberoastable Accounts
   • C. Find Computers with Unconstrained Delegation
   • D. Map Domain Trusts
   Show answer

   Correct: A. The 'Shortest Paths to Domain Admins' pre-built query renders the attack-path edges leading into the Domain Admins group. The other queries answer different questions (roastable users, delegation, trusts).

5. Which SharpHound collection method is required so BloodHound can compute who is logged on where and build the HasSession edges used for lateral-movement paths?

   • A. Session (or the All / LoggedOn collection set)
   • B. ACL only
   • C. Trusts only
   • D. Container only
   Show answer

   Correct: A. Session collection enumerates active logon sessions on remote hosts to create HasSession edges. ACL, Trusts, and Container collect ACEs, trust relationships, and OU/GPO structure respectively but not live sessions.

Last updated: 2026-10-19

CRTP practice test FAQ