CompTIA PenTest+ (PT0-003) PT0-003 — Question 307

A penetration tester wants to laterally move and escalate privileges. The tester uses BloodHound to obtain the following information: regular.user → AdminTo → WS-MAINT-02 Domain Admin has active session on WS-MAINT-02 Before executing any attack, the tester observes the following: • There are no tickets in memory. • An existing Group Policy blocks the token manipulation tool. Which of the following attacks is the best way to achieve the tester's goal?