active directory

Internal assessments rarely need exotic exploits. They follow the credentials, and the controls that matter are the ones that stop credentials from spreading.

Interviewers ask for the protocol first because every AD attack is a protocol property used against you. The strong answer derives each attack from a step in the ticket flow, then attaches the control that breaks it.

NTLM proves you can answer a challenge. It never proves which server you meant to answer, so whoever sits in the middle can pass your answer to a server you never chose.

Two enterprise workhorses with very different designs. The scored answer explains each flow, where the trust lives, and the attacks that follow from it.

The group change is one event; the question is the chain behind it. The strong answer treats tier 0 as compromised until proven otherwise and works backwards from who made the change and with what credentials.

A credential that nobody legitimate ever uses produces an alert with almost no false positives. The craft is in placing it where an intruder looks and making sure it grants nothing.