Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Windoe > 04 > Flashcards

04 Flashcards

1
Q

___________ Used by winlogon.exe to start the user’s desktop process. (process name)

A

Userinit.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

____________ Started by winlogon.exe to retrieve user credentials. (Process name)

A

Logonui.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

____________ contains a SID sub-key for all loaded user profiles
(registry keys)

A

HKU User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

____________ contains specific information about the hardware, software, and preferences for all users who log into the system
(registry keys)

A

HKLM Local Machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

____________ contains user profile environment settings of the interactively logged on user
(registry keys)

A

HKCU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

___________ is used to establish the current hardware configuration
(registry keys)

A

HKCC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

___________ is used to associate file types with programs that are used to open them. (registry keys)

A

HKCR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which of the following are HKLM subkeys?
BCD000000000
Hardware
SAM
SECURITY
NTUSER
APPEVENTS
SYSTEM
SOFTWARE
NTDS
SERVICE

A

BCD000000000
Hardware
SAM
SECURITY
SYSTEM
SOFTWARE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

__________ uses user authentication packages to perform user credential verification

A

Iaass.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The hypervisor context of Kernal mode in the lower section is there to increase security T/F?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

____________ is the lower section of kernel mode, where the hyper-v hypervisor executes, providing a security buffer between the hardware and the actual kernel of the OS

A

Kernal Mode (HyperVidor Context)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

___________ is the kernel process. When executed during the boot sequence, it provides the kernel and executive functions within kernal mode.

__________ and ___________ run in the context of this

A

NTOskrnl.exe

Hardware Abstarction and Native API DLLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

___________ is a kernel-loadable module that operates between the hardware and the windows executive so that app[lications and device drivers do not have to be aware of hardware-specific information

A

HAL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The ________ is the lower layer of ntoskrnl.exe and provides fundamental mechanisms used by the executive components and low-level hardware architecture support

A

Kernal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the Kernels four main responsibilities?

-
-

A

Thread Scheduling
Intterupt and Exception Handling
Low-level processor synchronization
Power failure recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The ____________ is the upper layer of ntoskrnl.exe and is the windows system call handler that verifies and provides kernel services

A

Executive

17
Q

___________ provides standardized interface for every system object

___________ enforces local security policy

____________ creates, manages, and terminates processes and threads

____________ provides private address space for each process

____________ processes all file and I/O requests; responsible for dispatching to device drivers as well as plug and play capabilities

___________ passes messages between client and server processes on the same computer

___________ responsible for implementing and managing the registry

A

Object Manager

Security reference moniter

Process Manager

Virtual memory manager

I/O manager

Asynchronous Local inter-processes communication

Configuration Manager

18
Q

Object criteria

  • C
  • H
  • P
  • D
  • SS
A

Each object belongs to a statistically defined class. A few object classes are file, key, process, and thread

A processes references objects via handles and must own a handle to an object before its threads use the object

Objects use pointers to reference and use other objects within kernel mode

Objects use hierarchical directories and naming structures in order to distinguish one object from another, query objects, and provide a way for processes to share objects.

Objects are protected by object-based security and support synchronization

19
Q

The Object header stores data and is used by the _____________ to manage objects regardless of their type or class

The _________________ is responsible for the object body

A

Object manager

Executive manager, responsible for whatever data type in it is

20
Q

Object header attributes

_____________ Makes an object visible to other processes for sharing

____________ determines who can use the object and what they can do with it

___________ counts the number of times a handle has been opened by an object

___________ points to a type object that contains attributes common to objects of this type

_________ counts the number of times a kernel mode component has referenced the address of the object via a pointer

A

Object Name

Security Descriptor

Open Handle Count

Object Type

Reference Count

21
Q

What are the two phases of object retention and there steps?

A

Name Retention
When handle count hits zero it deletes the name from its global name space

Object Deletion
when Refernce count hits zero the object is released, when both reference and handle count hit zero the object is deleted

22
Q

Where does the security descriptor source its information from? (3 things)

A

Default information depending on OS version and policies

inheritesd from a parent object

explicit permissions set by user (ACL)

23
Q

What are the two types of ACLS in the security descriptor and how are they described?

A

DACL
- empty dacl - no one can access it
- null dacl - anyone can access it

SACL controls how system audits object access attempts

24
Q

The ______ enforces security policies, guarding kernel mode resources by performing object access protection and auditing

A

SRM Security reference monitor

25
Q

What are the resources that the process manager requires?
HEAP IT

A

A List of open HANDLES to resources that all threads in the process use

An EXECUTABLE program (image file)

An ACCESS TOKEN that identifies the user, security groups and privileges associated with the process

A PRIVATE virtual address space

A Unique IDIENTIFIER that is called a process ID (PID)

At least one THREAD of execution

26
Q

What are the seven stages of process creation?

Stage 1:
Stage 2:
Stage 3:
Stage 4:
Stage 5:
Stage 6:
Stage 7:

create executive process object

Executable calls create process function

subsystem notifications

system call opens the image file

finalize new process initialization

create initial thread

start execution of initial thread

A

Executable calls create process function

system call opens the image file

create executive process object

create initial thread

subsystem notifications

start execution of initial thread

finalize new process initialization

27
Q

What are the two main responsibilities of Virtual memory manager VMM?

A

mapping a process virtual address into physical memory

swapping physical memory contents to disk when running threads or system code tries to use more memory then available

28
Q

Within a 64-bit address space the lower 128TB half is reserved for _________ while the upper 128TB half is reserved for _________

A

User Space
Kernal Space

29
Q

Another name for virtual address space is _________
when its mapped to physical memory its called __________

Are they equally sized?

A

Page
Frame

yes

30
Q

What are the three states that pages can be in? What’s there definitions?

A

Free: page is not mapped to a page frame address

Reserved: Allows a thread to reserve a range of virtual addresses that are about to be committed

Committed: pages are mapped to a page frame address

31
Q

If reference to a page is invalid for any reason a ___________ is generated

A

page fault

32
Q

What are some of the reasons a page fault can be generated?

A

accessing a page that has been swapped out to disk
accessing a page that is not committed
attempting to write-to a page that is read-only
executing code in a page that is marked as “no execute”

33
Q

Windows provides _____________ to keep processes from potentially corrupting unauthorized address space

What are some of the ways it does this?

A

Private virtual address space
ACLs
No Execute
hardware-controlled memory protection

34
Q

____________ connects applications and system components to virtual, logical, and physical devices

A

I/O Manager

35
Q

____________ facility is a message-passing mechanism used to [pass requests and results between a client and a server process within a single machine

A

ALPC Asynchronous local inter-process communication

36
Q

______________ is responsible for implementing and managing the system Registry.

A

Configuration Manager

37
Q

Windows uses what mechanism to ensure drivers are approved for use?

A

driver signing

Windoe (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions