Basic Windows and Networking

Question 1

Explain the following windows commands

ipconfig
ping
tracert
nslookup
netstat

Answer 1

ipconfig - TCP/IP configuration of a windows system

ping - ICMP packets to test network connectivity

tracert - routes packets that take your computer to a destination host

nslookup - domain to ip information

Netstat - Displays network statistics including active network connections, routing tables, and listening ports

Question 2

Explain the following Windows commands

arp
route
hostname
ipconfig (/release) (/renew)
netsh

Answer 2

arp - displays and modifies the ARP cache which map to IP addresses to MAC addresses on a local network

route - used to display and manipulate the IP routing table including adding,removing, or modifying static routes

hostname Displays the hostname of the system which is used for identifying the system on the network

ipconfig (/release) (/renew) - USed to release and renew DHCP assigned IP addresses

netsh - Configure and monitor network settings, including interfaces, firewall, and routing

Question 3

Explain common Windows registries about security

HKEY_LOCAL_MACHINE\SYSTEM\

HKEY_LOCAL_MACHINE\SOFTWARE\

Answer 3

HKEY_LOCAL_MACHINE\SYSTEM - Controls configuration for system behavior, startup settings, and kernel parameters

HKEY_LOCAL_MACHINE\SOFTWARE - Controls configuration for software such as version numbers, installed paths, and info about software programs

Question 4

Explain the following subdirectories of the Windows Registry for
HKEY_LOCAL_MACHINE\SYSTEM\

1) CurrentControlSet\Control\Lsa
2) CurrentControlSet\Services\EventLog\Security
3) CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

Answer 4

1) CurrentControlSet\Control\Lsa - Contains account lockout policies, password policies, kerberos authentication settings
2) CurrentControlSet\Services\EventLog\Security - Contains auditing and logging security-related events on the system
3) CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy - Contains policies including outbound and inbound rules, logging configs

Question 5

Explain the following subdirectories of the Windows Registry for
HKEY_LOCAL_MACHINE\SOFTWARE\

policies\microsoft\windows\windows\update

Microsoft\windows NT\currentversion\EFS

\Policies\microsoft\windows defender

\microsoft\windows NT\CurrentVersion\ProfileList

Answer 5

policies\microsoft\windows\windows\update - update scheduling, installation behavior

Microsoft\windows NT\currentversion\EFS - Encrypting File System including default encryption algorithms and EFS cert management

\Policies\microsoft\windows defender - settings for AV and scanning options

\microsoft\windows NT\CurrentVersion\ProfileList - list of user profiles on the system

Question 6

Where is the windows SAM database located and its importance

Answer 6

Stores user account information including username and password hashes

located: C:\Windows\System32\Config\SAM