Definitions Flashcards

1
Q

Controls how the system audits object access attempts.

A

System Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Auditing - POPPSALAD

Network based access to computer and attempts to connect to shares; also known as authentication events.

A

Account Logon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Windows Architecture

Meet government and industry requirements for system security and protections against external tampering.

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Domain Controller Logs

_ _ logs = available when machine is configured as a DNS server.

A

DNS Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Subsystem DLLs

Contains basic functions; such as windows management, user input, text, etc. Allows use of GUI.

A

user32.dll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

HKLM Software

CurrentVersion\ _ = executes a program the next time a user logs on.

A

CurrentVersion\RunOnce

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Auditing POPPSALAD

When an object (file, folder, etc) is accessed that has a SACL.

A

Object Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SID

S-1-5-#s-__=

Administrator
User account

A

500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In a __, each system shares common configurations, resources, and security principles.

A

Domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Windows Registry

2 master keys are:

A

HKEY_USERS (HKU)
&
HKEY_LOCAL_MACHINE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

System Processes

The subsystem process. Subsystem DLLs run in the context of this process

A

csrss.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Auditing POPPSALAD

Changes to users rights, windows firewall, GPOs, audit or trust policies.

A

Policy Change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Data Types

Raw binary data; hardware component information stored as binary data.

A

REG_BINARY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

HKLM Software

CurrentVersion\__ = List of executables that run on system startup.

A

CurrentVersion\RUN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Logs

__ log= contains events logged by system components.

1st party

A

System Log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In a __, each system is considered standalone with regards to authentication and system security principles.

A

Workgroup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Subsystem DLLs

Part of the windows Graphic Device Interface that enables programs and applications to use graphics and formatted text.

A

gdi32.dll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Logs

__ log= contains events logged by programs.

3rd party

A

Application Log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Windows Registry

The registry is read during the following 3 times:

A

Boot Process
Application Startup
User Login

20
Q

Data Types

Most common value type consisting of 32-bit numbers expressed in decimal or hexadecimal.

A

REG_DWORD

21
Q

Master Keys

Contains a SID sub key for all loaded user profiles. Profile environment settings are stored in each users ntuser.dat file and are loaded at logon.

A

HKEY_USERS

HKU

22
Q

Security Policy

Ability of an account to perform a particular system related operation.

Shut down, back up, file ownership, etc

A

Prívela he’s

23
Q

Domain Controller Logs

___ log= contains information about replication events including changes to SYSVOL.

A

File Replication Service

24
Q

Domain information is maintained by a centralized database known as _ _.

A

Active Directory

25
Q

Subsystem DLLs

Part of an advanced API library including several for security and registry calls. Phasing our with 6.1 architectures.

A

advapi32.dll

26
Q

Windows Architecture

Protects itself from internal malfunctions and faulty applications.

A

Reliability

27
Q

SID

S-1-5-__ =

Local System
Service Account

A

18

28
Q

Windows Architecture

Code written for adaptability and change to meet ever changing market demands.

A

Extensibility

29
Q

Windows Registry

3 derived keys are:

A

HKEY_CLASSES_ROOT (HKCR)
HKEY_CURRENT_USER (HKCU)
HKEY_CURRENT_CONFIG (HKCC)

30
Q

Windows Accounts

Controlled by the OS and provide the account identifier information for services.

A

Service Account

31
Q

HKLM Subkeys

HKLM\___= contains cached logins and local security policy.

A

HKLM\SECURITY

32
Q

HKLM Subkeys

HKLM\___= contains local account information as well as password values.

A

HKLM\SAM

33
Q

Data Types

A fixed-length text string

A

REG_SZ

34
Q

Package of PS commands consisting of cmdlets, functions, and aliases.

A

Module

35
Q

CL Registry

Displays object value

A

Reg query

36
Q

Derived Keys

Contains user profile environment settings of the interactively logged in user. Derived from HKU\SID.

A

HKEY_CURRENT_USER

HKCU

37
Q

HKLM Subkeys

HKLM\___= contains control sets from which HKCC is derived.

A

HKLM\SYSTEM

38
Q

Domain Controllers Logs

_ _ log = contains events logged by active directory. Enabled when active directory is loaded.

A

Directory Service

39
Q

SID

S-1-5-_=

Network Service
Service Account

A

20

40
Q

Windows Registry

_ _= Microsoft guidelines direct that 3rd party programs install specific application settings in the following key and its subkeys:
HKLM\Software\

A

Application Startup

41
Q

SID

S-1-5-__=

Local Service
Service Account

A

19

42
Q

HKLM Subkeys System

Control set the booted

A

ControlSet001

43
Q

Auditing POPPSALAD

When a user accessed a directory service object with a SACL.

Domain Objects.

A

Directory Service Access

44
Q

HKLM Subkeys

HKLM\___= contains a collection of subkeys for various installed components and programs.

A

HKLM\SOFTWARE

45
Q

Windows Accounts

__ Account = a collection of information used by the system determining accessed and privileges.

A

User Accounts

46
Q

Derived Keys

Used to associate file types with programs that are used to open them. Derived from HKLM and HKU.

A

HKEY_CLASSES_ROOT

HKCR

47
Q

Contains all domain accounts and other domain resource information.

A

Domain Controller