A penetration tester gains valid domain user credentials through a phishing simulation and then performs a Kerberoasting attack. What does Kerberoasting retrieve and how is it exploited?

Kerberoasting retrieves Kerberos service tickets for accounts with Service Principal Names. These tickets are encrypted with the service account's password-derived key, allowing offline brute-force or dictionary attacks to recover plaintext passwords. The Active Directory replication data option is wrong because replicating all Active Directory hashes is a DCSync attack requiring elevated privileges, not Kerberoasting. The OAuth tokens option is wrong because Kerberoasting targets on-premises Kerberos authentication, not OAuth or cloud services. The NTLM challenge-response hashes option is wrong because NTLM hashes captured over the network are retrieved through Responder in NTLM relay attacks, a different technique.