Kerberoasting Attack Next Step
Short answer
D Request a service ticket for the service principal name of the target service account.
Question
Key Takeaways
The attack tests knowledge of the Kerberoasting workflow, where the common trap is confusing the pre-requisite (requesting the ticket) with the post-exploitation tool usage (Mimikatz).
This question identifies the immediate next step in a Kerberoasting attack after obtaining a TGT. It establishes that requesting a service ticket is the critical action required to obtain the encrypted hash for offline cracking.
Common mistake: Option C is the most common wrong answer because candidates assume the goal is immediate extraction; however, Mimikatz is used later to decrypt the obtained ticket, not to request it.
Expert Analysis
Why the Answer Is Correct
The correct next step is to request a service ticket (ST) for the target Service Principal Name (SPN). In a Kerberoasting attack, the attacker uses their valid TGT to authenticate to the Key Distribution Center (KDC) and requests an ST for a specific service account. The KDC returns this ticket encrypted with the service account's NTLM password hash.
Why the Other Options Are Wrong
Option A is incorrect because Kerberoasting is an active attack requiring interaction with the KDC, not passive sniffing. Option B refers to PRINCE, which is a password cracking algorithm used after the hash is obtained, not during the ticket acquisition phase. Option C describes using Mimikatz to extract credentials from memory or process dumps, which is a separate technique or a subsequent step, but cannot happen until the service ticket is actually requested and received.
Community Comment Notes
Community members overwhelmingly selected D, noting that while Mimikatz (Option C) is associated with credential dumping, it is not the step taken immediately after having a TGT in this specific context. As one user noted, "according to the handbook, the next step in the attack after TGT is the Service Ticket Request." Another commenter clarified that Option C is not used to target a specific account directly in this flow, reinforcing D as the procedural next step.
Exam Strategy
When analyzing attack chains, always look for the immediate sequential step. Do not jump to the final result (cracking) if the prerequisite action (obtaining the data) hasn't been performed yet.
Frequently Asked Questions
Why is Mimikatz not the correct next step?
What is the difference between TGT and ST in this attack?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
insaniunt 👍 3 Answered DD. Request a service ticket for the service principal name of the target service account
-
LordXander 👍 2 Answered DSo option C might be tempting, however it is not used to target a specific account (a service account), hence D would be a "more correct" option. And, according to the handbook, the next step in the attack after TGT is the Service Ticket Request...so D
-
[Removed] 👍 1Im a bit hesitant about the validity of this claim
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.