A penetration tester gains valid domain user credentials through a phishing simulation and then performs a Kerberoasting attack. What does Kerberoasting retrieve and how is it exploited?

D is correct because Kerberoasting requests Kerberos TGS tickets for service accounts with Service Principal Names (SPNs). These tickets are encrypted with the service account's password hash, allowing offline brute-force or dictionary attacks to recover the plaintext password. A is wrong because replicating all AD hashes is a DCSync attack requiring elevated privileges, not Kerberoasting. C is wrong because NTLM hashes captured over the network are retrieved through Responder in NTLM relay attacks, a different technique. B is wrong because Kerberoasting targets on-premises Kerberos authentication, not OAuth or cloud services.