Immediate Remediation for Kerberoasting Attack

312-50v12 By islever Editorial Last updated

System Hacking

Short answer

D Invalidate the TGS the attacker acquired.

Question

A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for offline cracking. But the attacker was stopped before he could complete his attack. The system administrator needs to investigate and remediate the potential breach. What should be the immediate step the system administrator takes?
  1. Perform a system reboot to clear the memory
  2. Delete the compromised user's account
  3. Change the NTLM password hash used to encrypt the ST
  4. Invalidate the TGS the attacker acquired Correct Answer

Key Takeaways

Tests the distinction between immediate containment and long-term remediation in Kerberos security, highlighting that invalidating active tickets is the first priority over changing passwords.

This question addresses the immediate remediation steps following a detected Kerberoasting attack where TGS tickets were extracted from memory. The correct action is to invalidate the compromised Ticket Granting Service (TGS) ticket to immediately prevent unauthorized access.

Common mistake: Many learners choose to change the service account password (Option C) because it prevents future offline cracking of the hash. However, this ignores the immediate threat: if the attacker already has a valid TGS ticket in memory or captured before the password change, they can still use it until it expires or is explicitly invalidated.

Expert Analysis

Why the Answer Is Correct

The correct answer is D: Invalidate the TGS the attacker acquired. In a Kerberoasting attack, the attacker extracts a TGS-REP message encrypted with the service account's NTLM hash. If the administrator changes the password (Option C), the hash changes, but any TGS tickets issued before the change remain cryptographically valid until their lifetime expires. To stop an active attack or prevent the use of a captured ticket, the administrator must revoke or invalidate that specific ticket immediately using tools like klist or Active Directory management consoles.

Why the Other Options Are Wrong

Option A (Reboot) is impractical for a domain controller and does not address the network-level validity of the ticket. Option B (Delete account) is too drastic and causes service disruption; it also doesn't invalidate existing tickets issued prior to deletion. Option C (Change password) is a critical subsequent step to ensure the cracked hash becomes useless for future authentication or replay, but it is not the immediate step to stop the currently acquired ticket from being used.

Community Comment Notes

The community was split, with many arguing for Option C based on the logic that 'changing the password stops the attack.' However, users like 'insaniunt' correctly noted that invalidating the ticket prevents usage regardless of whether the password is cracked. User '49f4430' emphasized that the question asks for the 'immediate step,' making ticket invalidation the primary action before password rotation.

Exam Strategy

Always look for keywords like 'immediate step' or 'first action.' In incident response scenarios involving active exploitation, containment (stopping the current breach) often precedes eradication (removing the cause). For Kerberos attacks, remember that tickets have lifetimes; changing a password does not instantly kill existing tickets.

Frequently Asked Questions

Why isn't changing the password the immediate step?

Changing the password updates the hash but does not invalidate TGS tickets already issued. Those tickets remain valid until expiration unless explicitly revoked.

How do you invalidate a TGS ticket in Windows?

Administrators can use the klist purge command or manage Active Directory accounts to reset the password, which effectively invalidates future tickets but requires explicit revocation for existing ones.

More 312-50v12 FAQ →

Community Votes

D
57%
C
43%

57% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. insaniunt 👍 6 Answered D
    D. Invalidate the TGS the attacker acquired: This is the best option among the four. Invalidating the TGS ticket will prevent the attacker from using it to access the network service, regardless of whether he cracks the password hash or not. This will effectively stop the Kerberoasting attack and protect the network from further compromise.
  2. kennels 👍 5 Answered C
    If the TGS ticket is disabled but the password is not changed, the attacker should be able to obtain the victim's password through offline cracking of the issued TGS and connect to the network entity, I think.
  3. przemyslaw1 👍 3
    C. Change the NTLM password hash used to encrypt the ST because the TGS is encrypted using the target service accounts’ NTLM password hash
  4. noyon2002 👍 2
    I Think C, the key word her is : But the attacker was stopped before he could complete his attack, that means he cannot access with the ticket acquired, and the after that the sentence said The system administrator needs to investigate and remediate the potential breach, so he should change the NTLM PWD hash used to encrypt the ST
  5. 0af6dbd 👍 2
    Option C - Change the NTLM password hash used to encrypt the ST because the TGS is encrypted using the target service accounts’ NTLM password hash
Show 9 more comments
  1. Spam_Protection 👍 1 Answered D
    Module 4 P.416: To crack the ST, attackers export the TGS tickets from memory and save them offline to the local system. Furthermore, attackers use different NTLM hashes to crack the ST and, on successfully cracking it, the service account password can be discovered. Attackers use tools such as Kerberoast to perform Kerberoasting attacks on Kerberos authentication.
  2. LordXander 👍 1 Answered D
    The correct answer would be C & D. That would be complete..however, the most correct answer would be D since this would stop the Cyber Killchain (exploitation)...but if I would have this question in the exam...toss a coin
  3. dellalba 👍 1 Answered D
    The most insidious part about this attack is you can change the password for the KRBTGT account, but the authentication token is still valid. You can rebuild the DC, but that authentication token is still valid.
  4. 49f4430 👍 1 Answered D
    You Invalidate the ticket and after you change the password. If you change the password the ticket is still valid... The question ask for immediate action : Action Nr.1 : Invalidate the ticket
  5. KalingaDev 👍 1 Answered C
    Changing the password will be more effective, otherwise, the same attack can happen.
  6. F4ll3n92 👍 1
    the question ask the immediate step to do...so, i think that the correct answer is D
  7. LeongCC 👍 2 Answered C
    ChatGPT checked C
  8. cloudgangster 👍 2 Answered D
    D is it.
  9. przemyslaw1 👍 1 Answered C
    C. Change the NTLM password

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide