Question
During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?
- A. Golden Ticket
- B. Kerberoasting Correct
- C. DCShadow
- D. LSASS dumping
Explanation
Kerberoasting requests Kerberos service tickets for accounts that have a service principal name (SPN) and cracks them offline, because those tickets are encrypted with the service account's password hash. A Golden Ticket needs the krbtgt hash, DCShadow needs rights to register a rogue domain controller, and LSASS dumping needs local administrative access to a host, none of which depends on knowing an SPN.
