Which technique registers rogue domain controllers to push changes into AD?

• A. Mobile Devices Security
• B. Code Injection
• C. DCSync
• D. DCShadow

Answer: (D)

DCShadow is about inserting a rogue domain controller into Active Directory and using replication to push changes across the directory. An attacker who can bring up a rogue DC makes it appear as a legitimate DC in the domain’s replication topology. Once connected, that device participates in AD replication, which allows the attacker to propagate modifications—such as new accounts, altered permissions, or changed ACLs—as if they came from a real DC. That’s why this technique is the one that registers rogue domain controllers to push changes into AD.

This differs from methods aimed at credential theft (which pull data from DCs) and from generic security techniques or code-level exploits; those approaches don’t involve inserting a fake DC into AD’s replication flow to push changes.