Attack Chain and Lateral Movement Questions

Covers how adversaries progress from initial access through enterprise environments to achieve their objectives by moving laterally, escalating privileges, maintaining persistence, and compromising high value targets. Candidates should demonstrate knowledge of the stages of an attack chain including initial access vectors, discovery and reconnaissance, credential theft and reuse, privilege escalation techniques, persistence mechanisms, and lateral movement methods across systems and trust boundaries. Topics include common techniques used against identity and directory services such as Active Directory compromise and domain takeover, examples of credential abuse such as pass the hash and pass the ticket, ticket and service ticket attacks including Kerberoasting and Golden Ticket scenarios, and lateral transport mechanisms such as Remote Desktop Protocol, Server Message Block, Windows Management Instrumentation, remote execution tools, and scheduled tasks. Candidates should also be able to explain how attackers maintain long term access, clean up or tamper with logs, and move from footholds to sensitive data or critical infrastructure. Finally, assessment may include detection and mitigation strategies such as network segmentation, least privilege, credential hygiene and rotation, logging and monitoring approaches, endpoint detection and response, and incident containment and remediation considerations.