Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSED Windows > Final: Windows Security > Flashcards

Final: Windows Security Flashcards

1
Q

What is a SID?

A

Security Identifiers (SIDs)
- a numeric value that the OS uses to uniquely identify each user, group and computer
EX:
-S-1-5-21-1755044629-3020680732-3373738565-1287

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a RID?

A

Relative identifier (RID)
- RIDs uniquely distinguish one
user or group from another
EX:
- S-1-5-21-1755044629-3020680732-3373738565-1287
(Last 4 digits of the SID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can I view the SID of the current user?

A

whoami /all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Authority value for Null Authority

A

0
EX:
S-1-0-21-1755044629-3020680732-3373738565-1287

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Authority value for World Authority

A

1
EX:
S-1-1-21-1755044629-3020680732-3373738565-1287

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Authority value for Local Authority

A

2
EX:
S-1-2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Authority value for Creator Authority

A

3
EX:
S-1-3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Authority value for Non-Unique Authority

A

4
EX:
S-1-4-21-1755044629-3020680732-3373738565-1287

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Authority value for NT Authority

A

5
EX:
S-1-5
S-1-5-19

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Authority value for Resource Manager Authority

A

9
EX:
S-1-9-21-1755044629-3020680732-3373738565-1287

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Where are SIDs stored?

A

HKLM\SAM\SAM\Domains\Account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When is a SID created?

A

At creation of that account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How long do SIDs last?

A

For the life of the account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Can a SID be reused?

A

No, each one will always be unique to that local computer or domain
One Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an Authority value in a SID?

A

the highest level of authority that can issue SIDs for a particular type of security principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the 5 components of a SID?

A

1) SID string indicator
2) revision level
3) Authority value
4) Sub-authority value
5) RID value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Are RIDs ever reused?

A

No, not even after deletion of an account from that system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where are RIDs stored?

A

HKLM\SAM\SAM\Domains\Account

19
Q

Where to find next RID to be used?

A

in HKLM\SAM\SAM\Domains\Account, under the “F” value

20
Q

What is the RID for the built-in local administrator?

A

500

21
Q

What is the RID for the built in local guest?

A

501

22
Q

What is the domain admins group RID?

A

512

23
Q

What is the domain users group RID?

A

513

24
Q

What is the domain guest group RID?

A

514

25
Q

What is the RID of the built-in admins group?

A

544

26
Q

How do I get all the SIDs of the users on a system?

A

Get-CimInstance Win32_UserAccount | Select-Object Name,SID

27
Q

what is a user token?

A

(aka: access token, security token)
Value created at logon for a user, remains until session is closed. Contains user sid, sid of groups, & privileges. Cannot be modified.

28
Q

Can a token be modified?

A

No

29
Q

How long is a token active?

A

remains active for the duration of the user’s logon session

30
Q

If user has a privilege change, when will that reflect their token?

A

After next logon, when their new token is created

31
Q

What does the user token contain?

A
  • The user’s SID
  • The SIDs of any groups of which the user is a member
  • The user’s privilege array
32
Q

What is a privilege array?

A

contains any privileges that have been granted to the user.
Privileges define a user’s rights on the system and are enforced by the specific
subsystem the privilege affects

33
Q

What is a privilege?

A

permission to perform an action

34
Q

Why would a user have a large access token?

A

The number of privileges that have been granted to a user affects the logical size of the user’s access token. The greater the number of privileges a user has, the larger the access token

35
Q

What does SeBackupPrivilege do?

A

Allows the user to perform backups to files and folder

36
Q

What does SeCreateTokenPrivilege do?

A

Permits the creation of a token

37
Q

What does SeImpersonatePrivilege do?

A

Allows the user to impersonate another user after logon

37
Q

What does SeDebugPrivilege do?

A

Required when running debugger programs

38
Q

What does SeLoadDriverPrivilege do?

A

Allows the user to load and unload device drivers

39
Q

What does SeRestorePrivilege do?

A

Allows the user to restore files and directories

40
Q

What does SeTakeOwnershipPrivilege do?

A

Permits the user to take ownership of files and other objects (grants the user the WRITE_DACL permission)

41
Q

What does SeTcbPrivilege do?

A

Allows the user, or process/thread running in the context of the user, to act as part of the OS

42
Q

What invokes the object access process?

A

User requests a specific type of access to an object, such as requesting to open a file with write access.

43
Q
A

CSED Windows (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions