Câu 14: 312-50V13: Certified Ethical Hacker v13

A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for offline cracking. But the attacker was stopped before he could complete his attack. The system administrator needs to investigate and remediate the potential breach. What should be the immediate step the system administrator takes?

1. A. Perform a system reboot to clear the memory
2. B. Delete the compromised user's account
3. C. Change the NTLM password hash used to encrypt the ST — đáp án hiện tại
4. D. Invalidate the TGS the attacker acquired