Fundamentals of Cyber security Operations - Week 2 Flashcards

1
Q

Which software is used for exploring processes in Windows ?

A

SysInternals Suite , process explorer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is thread ?

A

A thread is a unit of execution in process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an handle ?

A

A handle is an abstract reference to memory block or objects managed by an Operating System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How to view handles of a process ?

A

We have to use sysinternals processexplorer tool , Navigate to view, then lower pane view

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an Windows registry ?

A

The windows registry is a hierarchical database that stores most of the operating systems and Desktop Environment configuration settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How to open registry editor

A

In search window , search for regedit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How many hives are in registry editor

A

Total 5 hives are in registry editor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which Registry hive stores hardware information use at boot-up ?

A

HKEY_CURRENT_CONFIG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which registry hive store settings and configurations for all users

A

HKEY_USERS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which registry hive Store local computer configuration

A

HKEY_LOCAL_MACHINE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which registry Hive stores settings and configuration of current user

A

HKEY_CURRENT_USER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How to change a end user licence agreement key value of process Explorer.

A

Click to select Process Explorer in HKEY_CURRENT_USER > Software > Sysinternals > Process Explorer. Scroll down to locate the key EulaAccepted.
Change the 1 to 0 for Value data. The value of 0 indicates that the EULA was not accepted. Click OK to continue.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which tool is used in Windows to write automated scripts ?

A

Powershell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How to know the alias of commands in PowerShell ?

A

Get-Alias dir

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which command is used in PowerShell to see live network traffic.

A

netstat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How to display routing table in PowerSwell ?

A

netstat -r

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How to empty Recycle bin using powershell ?

A

Open PowerShell & type clear-recyclebin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Types of Memory for processes in Windows

A

There are two main types of memory usage:
1. working set
2.private working set.
The private working set is the amount of memory used by a process that cannot be shared among other processes, while working set includes the memory shared by other processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is an Task Manager ?

A

The Task Manager is a system monitor program that provides information about the processes and programs running on a computer. It also allows the termination of processes and programs and modification of process priority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How to open System Logs in Event Viewer ?

A

Computer Management >System Tools > Windows Log >System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When was vi editor is created ?

A

vi editor is created in 1976

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the updated version of vi editor?

A

vim is the person of vi editor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which file contains configuration settings of user terminal

A

bashrc contains configuration for the terminal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which configuration file is responsible to define the prompt structure of the prompt displayed by the terminal

A

bashrc file
For example, the line PS1=’[\e[1;32m][\u@\h \W]$[\e[0m]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which directory contains configuration files related to system wide services ?

A

/etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the name of text editor in arch linux ?

A

SciTE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the name of light weight web server in arch linux?

A

nginx

28
Q

how to kill a program nginx in arch linux ?

A

pkill nginx

29
Q

How to search a command in man ?

A

man -k grep

30
Q

What means single . dot with cd ?

A

It means present working directory

31
Q

What is the CDN of Amazon Web Services

A

Amazon CloudFront

32
Q

What is command to display process running in background ?

A

ps -elf

33
Q

What is command to display current running process hierarchy ?

A

ps - ejH

34
Q

What is the default port of telnet

A

tcp port 23

35
Q

Why we not use telnet ?

A

Telnet will transmit data in clear text, it does not provide encryption

36
Q

How to exit from telnet ?

A
37
Q

What is systemd in Linux ?

A

Systemd is a modern init system

38
Q

What is init system ?

A

An init system is a set of rules and conventions governing the way the user space in a given Linux system is created and made available to the user. Init systems also specify system-wide parameters such as global configuration files, logging structure and service management.

39
Q

When init process starts

A

init process start at boot time .

40
Q

Which is the first process of Linux System

A

In Linux, the init process is the first process loaded when the computer boots. Init is directly or indirectly, the parent of all processes running on the system. It is started by the kernel at boot time and continues to run until the computer shuts down. Typically, init has the process ID 1

41
Q

Which process has the process ID 1

A

I init process has the process ID 1

42
Q

Which is the event logging service of systemd

A

system-journald or journald

43
Q

What do you mean by mounting a filesystem ?

A

Mounting a file system means make it accessible to operating system.
Mounting a file system is a process of linking the physical partition on the block device(Hard Didk, SSD, pendrive etc) to a directory

44
Q

What is a Mount point ?

A

Mount point is the directory where a file system is linked ?

45
Q

What are the different types of file systems in Linux ?

A

ext3, ext4

46
Q

What is the example of block device ?

A

Hard Didk, SSD, pendrive etc

47
Q

In which file system Linux operating system is stored ?

A

Linux operating system is stored in root filesystem

48
Q

In which format will chmod command takes permissions ?

A

The chmod command take permission in the octal format (0-7 video)

In that way, a breakdown of the 665 is as follows:

6 in octal is 110 in binary. Assuming each position of the permissions of a file can be 1 or 0, 110 means rw- (read=1, write=1 and execute=0).
Therefore, the chmod 665 myFile.txt command changes the permissions to:
Owner: rw- (6 in octal or 110 in binary)
Group: rw- (6 in octal or 110 in binary)
Other: r-x (5 in octal or 101 in binary)

49
Q

What are the three types of Linux permissions?

A

Three Types of Linux permissions are, 4 2 1 read write execute
Read = 4
write= 2
Execute = 1

50
Q

What is Setuid, setgid, and the sticky bit ?

A

setuid: a bit that makes an executable run with the privileges of the owner of the file

setgid: a bit that makes an executable run with the privileges of the group of the file

sticky bit: a bit set on directories that allows only the owner or root can delete files and subdirectories

https://www.cbtnuggets.com/blog/technology/system-admin/linux-file-permissions-understanding-setuid-setgid-and-the-sticky-bit

51
Q

Why some commands required root privileges to execute ?

A

Some command requires root privileges to execute because , setuid & setgid is used. It means an executable run only with the privileges of the owner of the file.

52
Q

How many bits are reserved for permissions in file & directories

A

Total 9 bits are reserved for files and directories to set permissions
rwx rwx rwx
3 + 3 + 3

53
Q

What is the difference between file and directory permission ?

A

Execution bit in files and directories means different. Executive power file to
A file with the execution bit set is an executable script or program.
A directory with the execution bit set specifies whether a user can enter that directory.

54
Q

How many types of files are in Linux ?

A

There are three types of files in Linux,
1. Regular files
2. Directory files
3. Special files

55
Q

How regular file denoted by LS command ?

A

regular file denoted by “ - “

56
Q

How directory files denoted by LS command ?

A

Directory files denoted by “d”

57
Q

How many types of special files in Linux ?

A

We have five types of special files in Linux,
1. Block Files
2. Character device files
3. Pipe files
4. Symbolic Link files
5. Socket Files

58
Q

How block files are denoted by LS command ?

A

Block files are denoted by “b”

59
Q

How character files are denoted by LS command ?

A

Character files are denoted by “c”

60
Q

How pipe file are denoted by ls commands ?

A

Pipe files are denoted by “p”

61
Q

How Symbolic link files are denoted by LS command ?

A

Symbolic links files are denoted by “ l “

62
Q

How socket files are denoted by ls command ?

A

Socket files are denoted by “s”

63
Q

Where we find all types of files ?

A

In /dev/ we find all three types of files.

64
Q

How many types of links in Linux ?

A

In Linux we have two types of links,
1. Symbolic Links chij Hai Ki
2. Hard links

65
Q

How many minimum sub-drectory counts are in a directory, while using ls command ?

A

Minimum count is two . & .. ,
. is for itself
. . is for going to parent directory

66
Q

If we rename the file , then what happenes to its symbolic links ?

A

Symbolic links are no longer accessible , but they listed by ls command .