Active Directory (AD) underpins most enterprise networks, so AD attack paths are a favourite topic in penetration testing and red team interviews. You should be able to explain a realistic attack path clearly and safely.
Why Active Directory matters to attackers
AD manages authentication and authorisation across an organisation. Compromising it often means compromising the whole domain, so attackers focus heavily on it after gaining an initial foothold.
A typical attack path
- Initial foothold — phishing or an exposed service.
- Enumeration — mapping users, groups, and misconfigurations (tools like BloodHound reveal attack paths).
- Credential access — for example Kerberoasting.
- Lateral movement — moving between hosts using stolen credentials.
- Privilege escalation — reaching Domain Admin.
- Domain dominance / persistence — maintaining access (within scope, in a legitimate test).
Key techniques to understand
- Kerberoasting: requesting service tickets (TGS) for accounts with Service Principal Names, then cracking them offline to recover passwords. Remediate with strong service-account passwords and Group Managed Service Accounts.
- Pass-the-Hash: authenticating with an NTLM hash instead of a plaintext password.
- Pass-the-Ticket / Golden & Silver Tickets: abusing Kerberos tickets.
- Lateral movement techniques: PsExec, WMI, RDP, and abusing legitimate admin tools.
Likely questions
- Explain a typical Active Directory attack path.
- What is Kerberoasting and how do you defend against it?
- How does pass-the-hash work?
- What is BloodHound and why is it useful?
- How would you detect lateral movement? (a great link to defensive work — see our SOC analyst guide).
How to prepare
Practise in a lab AD environment, understand both offence and the corresponding defences, and be ready to explain an attack path calmly and within a professional, authorised framing. Pairs with penetration tester interview questions and OWASP Top 10 interview questions.
Rehearse these under realistic pressure with AI Interview™, decode a specific vacancy with Job Intelligence™, close any gaps with Career Coach, and evidence your progress in your Career Passport™.
Connect attacks to defences
For each AD attack — Kerberoasting, Pass-the-Hash, Golden Ticket, DCSync — pair the technique with a defence: least privilege, tiered admin, strong service-account passwords, monitoring for anomalous ticket requests. Interviewers want to see you think like both attacker and defender.
Ground it in ATT&CK
Frame AD attacks within the MITRE ATT&CK credential-access and lateral-movement tactics, and explain how you'd detect them via SIEM telemetry. Understanding identity is central to zero trust and to any modern cyber security interview.