Kerberos, GPO, tiering, ACLs, attacks (Kerberoasting, DCSync), hardening, auditing.
Before starting, we run a 1-minute tech check — microphone, ambient noise, connection. If your setup isn't good enough, the test is fully refunded.
Prove you can lock down Kerberos, map attack paths in BloodHound and run a Tier 0 response — in a 15-minute AI oral that cuts through buzzword CVs.
The Plume Active Directory Security badge validates your real-world ability to harden, audit and defend a Windows domain. In a 15-minute AI oral (OpenAI Realtime), you are questioned on concrete scenarios: spotting DCSync traces on a domain controller, rolling out a Tier 0/1/2 model, countering Kerberoasting and AS-REP Roasting, and prioritizing attack paths surfaced by BloodHound or PingCastle. This is not a multiple-choice test. The AI follows your answers, drills into vague areas, and scores your actual technical depth.
Unlike a generic certification or a self-declared LinkedIn skill, this badge is built on a recorded oral session analyzed by Claude Opus, which produces a score from 0 to 100 and a level (Novice, Proficient, Advanced, Expert). The detailed report breaks down strengths and gaps across every dimension: Kerberos mastery, ACL management, SIEM and EDR integration, your stance on NTLM deprecation and recent CVEs. Recruiters and CISOs can access your badge via a public URL and listen to the recording if you allow it.
This badge is built for security engineers, IAM consultants, Active Directory administrators and pentesters working in on-premise or hybrid environments (AD plus Entra ID). Whether you are preparing for a large-scale enterprise engagement, a CISO interview, or simply want to benchmark your level before upskilling, the badge gives you a credible, timestamped and verifiable proof of your Active Directory security expertise.
Here are the concrete dimensions the AI examines during the 15-minute oral.
Explain the AS-REQ, TGT and TGS flows, identify accounts vulnerable to Kerberoasting and AS-REP Roasting, and describe concrete countermeasures: AES-only encryption, Protected Users group, gMSA service accounts.
Correlate Windows events 4624, 4768, 4769 and 4776 in a SIEM, identify DCSync traces (EventID 4662), Golden Ticket artefacts or Pass-the-Hash indicators, and lead containment and eradication on a compromised DC.
Classify critical assets into Tier 0 (DCs, PKI, ADFS), define dedicated admin accounts per tier, enforce logon restrictions via GPO and RBAC, and drive operational buy-in from infrastructure teams resistant to new constraints.
Use BloodHound to map compromise paths, PingCastle and Purple Knight for risk scoring, prioritize dangerous delegations (GenericAll, WriteDACL, DCSync rights) and build an actionable remediation plan.
Deploy security GPOs (LAPS, Credential Guard, Restricted Groups, SMB signing), phase out NTLM, enable LDAP signing and channel binding, and track ANSSI and Microsoft Secure Score AD recommendations.
Configure Entra Connect synchronization, assess the expanded attack surface introduced by password hash sync, pass-through authentication and seamless SSO, and define a Zero Trust strategy alongside a legacy AD.
Deploy a PAM solution (CyberArk, Thycotic, Microsoft MIM), implement just-in-time access, automate secret rotation for service accounts, and control admin sessions on Tier 0 assets.
Factor in post-CVE-2022-37967 Kerberos patches (PAC Privilege Attribute Certificate), Microsoft's announced NTLM deprecation timeline, and the impact of new LDAP signing requirements on legacy applications.
Final scoring is performed by Claude (Anthropic), which reads back the full transcript and applies this weighted criteria grid.
Depth of explanation on Kerberos internals (AS-REQ, PAC, delegation types), accuracy of attack descriptions (Kerberoasting, DCSync, Golden Ticket) and relevance of countermeasures cited (AES-only, Protected Users, SID filtering).
Ability to describe concrete engagements with specific details: domain size, incident type, tools actually used. The AI assesses the plausibility and richness of the examples shared.
Relevant use of BloodHound, PingCastle, Purple Knight and Windows event logs. Method for prioritizing attack paths and ability to translate technical findings into an actionable remediation plan.
Understanding of AD/Entra ID hybrid challenges, Zero Trust positioning, knowledge of Entra Connect synchronization risks (password hash sync, federation) and cloud-specific attack surfaces.
Ability to explain complex concepts (Kerberos, tiering, ACLs) in a clear, structured and accessible way, even under follow-up pressure from the AI examiner.
A Plume session takes about 20 minutes, from tech check to badge delivery.
Before starting, the AI checks that your microphone works, your connection is stable and you are in a quiet space. No tools, documentation or screens are allowed during the oral.
The AI examiner asks you to introduce yourself and describe your most recent Active Directory security engagement: company type, domain size, scope of your involvement.
The core of the exam: the AI works through the major themes (Kerberos, tiering, ACLs, incident detection, hybrid integration, recent changes). It adjusts the depth of its follow-up questions to your answers and drills into gaps.
The examiner asks you to step back: in what situations would you recommend migrating to Entra ID rather than continuing to harden an on-premise AD? What limits of AD hardening have you hit in practice?
Claude Opus analyzes the transcript, assigns a score from 0 to 100 and a level (Novice, Proficient, Advanced, Expert), and generates a detailed per-criterion report. Your badge is available immediately with a shareable URL.
Your score out of 100 translates into a level a recruiter can grasp at a glance.
You know the basics of Active Directory (users, groups, GPOs) but have not yet worked on AD security challenges in a professional context. You are not yet familiar with Kerberos internals, BloodHound or tiering models.
You have taken part in AD audits or hardening engagements, you understand the main attacks (Kerberoasting, DCSync) and you know how to run an initial scan with PingCastle or BloodHound. You can describe a tiering model even if you have not deployed one end-to-end.
You have designed and deployed secure AD architectures in production, including tiering, LAPS, Credential Guard and gMSA service accounts. You use BloodHound to prioritize attack paths and you know how to respond to a DCSync or Golden Ticket incident.
You are the go-to AD security reference in your organization or for your clients. You drive long-term hardening strategy, integrate AD with Entra ID and a PAM solution, track Kerberos CVEs and the NTLM deprecation roadmap, and mentor other engineers on AD security.
No degree or years of experience required to take the badge. Here are the profiles it makes the most sense for.
You attack AD environments during red team exercises and penetration tests, and you want to prove you also master the defensive and hardening side, not just Kerberoasting exploitation or misconfigured delegation abuse.
You monitor AD events in a SIEM (4624, 4768, 4769) and want to validate your ability to detect an AD compromise and respond to an incident involving a DC or a Tier 0 account.
You manage Windows domains day to day and want to benchmark your level on security topics (LAPS, Credential Guard, hardening GPOs, tiering) that you apply or still need to implement.
You are applying for a role that requires deep AD expertise and want a concrete proof point to bring to the interview, beyond general certifications like OSCP or CISSP.
Your enterprise clients ask for proof of competence before engaging you on an AD hardening project. The badge provides a verifiable URL and an objective score you can share upfront.
Where and how your Active Directory Security badge will help you day to day.
A consulting firm includes links to their consultants' Active Directory Security badges in a bid for a critical infrastructure AD hardening contract. The Expert score immediately backs up the team's claimed expertise.
A candidate for a security engineer role shares their badge before the technical interview. The hiring manager listens to the audio excerpt and arrives with targeted questions, cutting 30 minutes off the qualification process.
An independent IAM consultant sends their Advanced badge to a CTO before kicking off an AD-to-Entra ID migration project, proving they understand hybrid security risks without needing a prior technical screening call.
A Proficient-level AD admin receives a report pinpointing gaps in ACL auditing and Kerberos attack knowledge. They use it to target their training and retake the badge six months later to measure progress.
A CISO has their entire AD team take the badge to objectively map individual levels before setting the annual training plan. Scores reveal who is ready for Tier 0 ownership and who needs BloodHound coaching.
A security expert adds their Active Directory Security badge URL (Expert level, score 91/100) to their Toptal or LinkedIn profile. Clients can verify the result in one click without scheduling a technical test.
A few minutes to check you have everything you need.
At the end of your session you don't just get a score — here's everything that awaits you.
You receive a precise score out of 100 and a level (Novice, Proficient, Advanced, Expert) based on the AI's analysis of your actual mastery of Kerberos, tiering, ACLs and AD incident response.
Claude Opus generates a per-criterion report that highlights your strengths (e.g., strong grasp of Kerberos attack chains) and your growth areas (e.g., ACL delegation depth, PAM integration knowledge).
Your full 15-minute oral session is recorded and stored securely. You decide whether to grant recruiters and clients access to the audio or keep it private.
You get a unique public URL displaying your level and score. Add it to LinkedIn, your CV or a client proposal: anyone can verify your result in one click, no account needed.
Discover related skills you can validate with Plume.
A 15-min oral exam with an AI, a shareable badge for your recruiters.
Choose this badge · €19.99
