47.5 Identity Attacks Awareness (Kerberos / PTH – defensive talking points only)

Q37. What is Kerberos in one defensive sentence?

(Theme: Accenture SOC — candidate-reported; Deloitte AD-attack themes — AmbitionBox candidate-reported snippet.) Kerberos is a ticket-based authentication system common in Active Directory environments. Defenders care because ticket abuse and weak account hygiene enable privilege paths. I discuss detection and hardening, not attack recipes.

Q38. What is NTLM and why do defenders still care?

(Theme: Accenture SOC — candidate-reported.) NTLM is an older Windows authentication family still seen in compatibility paths. It has relay and hash-theft themes in attacker playbooks. Blue reduces NTLM where possible, requires signing/encryption controls, and monitors odd NTLM usage.

Q39. What is Pass-the-Hash at awareness level?

(Theme: Accenture SOC — candidate-reported.) Pass-the-Hash is reusing stolen password hashes to authenticate without needing the cleartext password. I do not give exploit steps. Defence: limit lateral admin, credential guard / modern OS features where fit, privileged access workstations, LAPS-style unique local admin passwords, and detect unusual auth patterns.

Q40. Golden Ticket versus Silver Ticket – what do you say safely?

(Theme: Accenture SOC — candidate-reported.) At awareness level: Golden Ticket themes relate to forging very powerful Kerberos tickets after serious KRBTGT-level compromise; Silver Ticket themes relate to service-ticket forgery for specific services. Interview answer focus: protect Tier-0 / KRBTGT, monitor anomalous ticket lifetimes and unusual TGS patterns (for example Event ID 4769 themes), rotate keys after suspected compromise per Microsoft guidance, and least-privilege service accounts. No forge steps from me.

Q41. What Kerberos-related Event ID themes should a SOC analyst know?

Frequently asked across MNC interviews (candidate-reported). 4769 (service ticket request) anomalies – odd SPNs, bursts, unusual hours – are common talking points. I pair IDs with baseline behaviour, not ID bingo alone.

Q42. How would you talk about Kerberoasting without teaching the attack?

I explain the idea that weak passwords on service accounts with SPNs are attractive targets, then pivot to Blue: long random service account passwords or gMSA, AES where fit, monitor odd 4769 patterns, and least privilege. Lab practice only on OWN AD lab if I build one – never on an employer domain without written authorisation.

Q43. Brute force versus password spray – difference?

(Theme: Accenture SOC brute-force theme — candidate-reported.) Classic brute force hits many passwords on one account; spray tries one or few passwords across many accounts to stay under lockout. Blue: smart lockouts, MFA, detect both patterns, protect service accounts, and watch VPN/OWA/SSH faces.

Q44. Why must identity answers stay ethics-first in MNC interviews?

Because interview theatre that sounds like a ready-to-run AD attack can fail a background/ethics check. I show I understand attacker goals so I can detect them – and I only practise on directories I own.