EC-Council LPT (Master) Exam: 200 Verified
Practice Questions with Detailed Rationales
Covering Active Directory, Cloud, Linux, Web,
Wireless, and Advanced Exploitation
Techniques for 2026/2027 Certification Success
🧠 LPT (Master) Practice Test Bank: 100
Questions
Domain 1: Advanced Windows Attacks &
Active Directory
Q1. Which hashcat mode is used to crack a
Kerberos 5 TGS-REP etype 23 (RC4-HMAC)
hash extracted using GetUserSPNs.py?
• A. -m 1000
• B. -m 13100
• C. -m 18200
• D. -m 5600
, • Correct ☑VERIFIED ANSWER: B
• Rationale: Kerberoasting extracts service
account TGS-REP hashes in
the $krb5tgs$23$* format. Hashcat mode -
m 13100 is specifically for cracking this type
of Kerberos 5 TGS-REP etype 23 hash. -m
18200 is for AS-REP Roasting, and -m
1000 is for NTLM hashes.
Q2. Which Impacket script is the standard tool
for performing a DCSync attack to extract
the krbtgt account hash from a domain
controller?
• A. psexec.py
• B. secretsdump.py
• C. wmiexec.py
• D. GetADUsers.py
• Correct ☑VERIFIED ANSWER: B
, • Rationale: secretsdump.py from the
Impacket suite is the primary tool for a
DCSync attack. It simulates a domain
controller's replication process to request
and extract password hashes from the
target DC, including the
critical krbtgt account hash. Obtaining this
hash allows an attacker to forge Golden
Tickets for persistent, unrestricted domain
access.
Q3. A penetration tester finds a user account
with the DONT_REQ_PREAUTH flag set. Which
attack does this enable, and what is the
correct Hashcat mode to crack the obtained
hash?
• A. Kerberoasting, -m 13100
• B. AS-REP Roasting, -m 18200
• C. Golden Ticket attack, -m 1000
, • D. Pass-the-Hash, -m 5600
• Correct ☑VERIFIED ANSWER: B
• Rationale: When
the DONT_REQ_PREAUTH (UAC bit
0x400000) flag is set, the KDC will issue an
AS-REP that is encrypted with the user's
password without validating a timestamp.
An attacker can request this AS-REP and
crack it offline. The hash format for AS-REP
Roasting is $krb5asrep$, cracked with
Hashcat mode -m 18200.
Q4. Which technique uses a forged service
ticket signed with a service account's NTLM
hash, bypassing the KDC entirely to
impersonate any user against that service?
• A. Golden Ticket
• B. Silver Ticket
Practice Questions with Detailed Rationales
Covering Active Directory, Cloud, Linux, Web,
Wireless, and Advanced Exploitation
Techniques for 2026/2027 Certification Success
🧠 LPT (Master) Practice Test Bank: 100
Questions
Domain 1: Advanced Windows Attacks &
Active Directory
Q1. Which hashcat mode is used to crack a
Kerberos 5 TGS-REP etype 23 (RC4-HMAC)
hash extracted using GetUserSPNs.py?
• A. -m 1000
• B. -m 13100
• C. -m 18200
• D. -m 5600
, • Correct ☑VERIFIED ANSWER: B
• Rationale: Kerberoasting extracts service
account TGS-REP hashes in
the $krb5tgs$23$* format. Hashcat mode -
m 13100 is specifically for cracking this type
of Kerberos 5 TGS-REP etype 23 hash. -m
18200 is for AS-REP Roasting, and -m
1000 is for NTLM hashes.
Q2. Which Impacket script is the standard tool
for performing a DCSync attack to extract
the krbtgt account hash from a domain
controller?
• A. psexec.py
• B. secretsdump.py
• C. wmiexec.py
• D. GetADUsers.py
• Correct ☑VERIFIED ANSWER: B
, • Rationale: secretsdump.py from the
Impacket suite is the primary tool for a
DCSync attack. It simulates a domain
controller's replication process to request
and extract password hashes from the
target DC, including the
critical krbtgt account hash. Obtaining this
hash allows an attacker to forge Golden
Tickets for persistent, unrestricted domain
access.
Q3. A penetration tester finds a user account
with the DONT_REQ_PREAUTH flag set. Which
attack does this enable, and what is the
correct Hashcat mode to crack the obtained
hash?
• A. Kerberoasting, -m 13100
• B. AS-REP Roasting, -m 18200
• C. Golden Ticket attack, -m 1000
, • D. Pass-the-Hash, -m 5600
• Correct ☑VERIFIED ANSWER: B
• Rationale: When
the DONT_REQ_PREAUTH (UAC bit
0x400000) flag is set, the KDC will issue an
AS-REP that is encrypted with the user's
password without validating a timestamp.
An attacker can request this AS-REP and
crack it offline. The hash format for AS-REP
Roasting is $krb5asrep$, cracked with
Hashcat mode -m 18200.
Q4. Which technique uses a forged service
ticket signed with a service account's NTLM
hash, bypassing the KDC entirely to
impersonate any user against that service?
• A. Golden Ticket
• B. Silver Ticket
