Kerberoasting abuses the fact that any authenticated domain user can request a service ticket for an account with a service principal name. The ticket is encrypted with that service account password hash, so the attacker takes it offline and cracks it. Detect it through 4769 volume anomalies, RC4 requests in an AES environment, one account requesting many distinct service tickets quickly, and requests for high value service accounts.
Why interviewers ask this
It is a standard screening question because it touches Active Directory internals, detection logic and mitigation in one answer. The interviewer wants to know you can explain why the attack works at the protocol level, not just name the tool. They also want the detection nuance, because 4769 alone is enormously noisy, so your answer needs an aggregation or anomaly angle plus the encryption downgrade tell.
How to structure your answer
- Explain the protocol behavior that makes the attack possible.
- State exactly what the attacker walks away with.
- Give a detection that survives the natural noise of 4769.
- Close with the mitigation that actually kills it.
Example answer
Any authenticated user can ask a domain controller for a service ticket for any account with a service principal name, and that ticket is encrypted with the service account password hash. So the attacker needs no special privileges at all. They request tickets in bulk, take them offline, and crack them at their leisure, and if the service account has a human chosen password with weak rotation they end up with domain credentials without generating a single failed logon. For detection, 4769 on its own is far too noisy to alert on, so I aggregate: one source account requesting more than a threshold of distinct service principal names inside a short window, and I weight heavily on RC4 requests in an environment where everything else negotiates AES. That downgrade is the tell. The real fix is group managed service accounts with long random passwords, because then the offline crack does not finish this decade, plus stripping service principal names off accounts that never needed one.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you tell Kerberoasting apart from a vulnerability scanner?
- What is AS-REP roasting and how does it differ?
- How would you find which service accounts are most at risk today?
Related cybersecurity analyst questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions