Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

70-744 > Manage Privileged Identities > Flashcards

Manage Privileged Identities Flashcards

JIT JEA PAWs LAPS

1
Q

What are some avenues of attack that lead to credential theft?

A
  • Logging into unsecured systems with privileged accounts
  • Browsing the internet with privileged accounts
  • Configuring local privileged accounts with the same creds across many systems
  • Overuse/overpopulation of privileged groups
  • Insufficient management of Domain Controller Security.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What kinds of accounts are often targeted in credential theft or privilege escalation attacks?

A
  • Permanently privileged accounts
  • VIP Accounts (CEO, CFO, etc.)
  • “Privileged-attached” directory accounts
  • Domain Controllers
  • Other identity servers (PKI, Management, etc.)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In which version of Windows were Audit Subcategories introduced?

A

Server 2008

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In which version of Windows were Advanced Audit Policies introduced?

A

Server 2008 R2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In which scenarios would you want to most commonly disable User Account Control (UAC)?

A

Server Core installations (it is disabled by default for Server Core)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

On a member server, if the local administrator account is disabled, does that prevent the account from being used in a break-glass/failsafe scenario?

A

No. If a system is booted into safe mode, the built-in administrator may be used even if disabled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In which version of Windows was RDP Restricted Admin Mode Introduced?

A

Server 2012 R / Windows 8.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does RDP RestrictedAdmin mode do?

A

RestrictedAdmin mode does not transmit the user’s credentials to the host by the RDP client. The RDP client attempts to do an interactive logon with the host. The host verifies the credentials and assures that the account has administrative rights and supports RDP RestrictedAdmin and connects.

Credentials are not sent in plain-text or any other reusable forms to remote systems with RDP RestrictedAdmin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a Pass The Hash (PtH) attack?

A

PtH is a technique where an attacker captures account credentials on one system and then uses them to authenticate to another computer on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are some fundamental requirements for a Pass-the-Hash attack to be successful?

A
  • Access to a system
  • Local administrative rights on a system
  • Access to a second, or more, system to use the discovered credentials.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the simplest way to prevent a Pass-the-Hash attack from occurring on a system?

A

Never logon to the system with privileged credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Lateral Movement?

A

An attacker user credentials obtained from a compromised system to gain access to another system of the same value in the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is privilege escalation?

A

Attacker uses credentials obtained from a compromised computer to gain access to another computer of higher value in the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are some locations where credentials are stored on a Windows computer?

A
  • SAM Database
  • Lsass Process
  • Active Directory Database
  • Credential Manager (CredMan)
  • LSA Secrets stored in the registry
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What behaviors on the network could result in a Pass-the-Hash being successful?

A
  • High privilege domain accounts used to logon to systems
  • Applications running with high privileges
  • Scheduled tasks running with high privileges
  • Local Admin rights given to ordinary accounts
  • Privileged accounts used to browse the internet
  • Same password used for all built-in Admin accounts
  • Account termination is not enforced in Domain Admin, EA, or other highly privileged accounts.
  • Poor update strategy
  • Shared accounts
  • Overprivileged and high privileged service accounts
  • Too many administrators
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are some common mitigations for Pass-the-Hash?

A
  • Restrict and protect highly privileged domain accounts
  • Restrict and protect local accounts with admin rights
  • Restrict inbound traffic via Windows Firewall
  • Restrict software on systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When considering Pass-the-Hash, what is meant by “Restrict and protect highly privileged domain accounts?

A
  • Limit number of admins
  • No email for administrative accounts
  • Limit logon servers
  • Use Smart Cards
  • Use Jump Servers / PAWs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When considering Pass-the-Hash, what is meant by “Restrict and protect local accounts with admin rights”?

A
  • Remove standard users from Local Admins

- Do not reuse built-in admin account passwords (LAPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

When considering Pass-the-Hash, what is meant by “Restrict inbound traffic via the Windows Firewall”?

A
  • Deny internet access for privileged accounts

- Limit where logons can come from

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When considering Pass-the-Hash, what is meant by “Restrict software on systems”?

A
  • Windows Updates should be installed regularly
  • Restrict which management tools that can be used and how
  • Remove LM and NTLM usage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a Pass-the-Ticket attack?

A

Similar to PtH except the Kerberos TGT is acquired and reused

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the default lifespan of a Kerberos ticket?

A

10 hours before renewal. 7 days before needing to be requested entirely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How are Pass-the-Ticket attacks less useful than Pass-the-Hash attacks?

A

Pass-the-Hash is valid until a user changes their password (30-90 days in most orgs; sometimes never)

Due to the nature of how Kerberos works, PtT tickets expire after a period of time limiting how long an attacker can store and use the tickets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Why is it bad to allow sensitive domain accounts to be trusted for delegation?

A

If the service or server being authenticated is trusted for unconstrained delegation, the client sends a TGT and session key. The attacker could use this information ti impersonate clients using the captured TGT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which type of IIS authentication utilizes Kerberos or NTLM?

A

IIS integrated Windows Authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the requirements for RDP RestrictedAdmin Mode?

A
  • Both source and destination servers must be Server 2012 / Windows 8 for Workstations or later.
  • Restricted Admin Mode must be explicitly enabled on the target system’s registry
  • Accounts connecting must be local admins on the destination server
  • Server 2012 systems may require an update to support RDP Restricted Admin
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How do you enable use of RDP Restricted Admin for destination systems?

A 
HKLM:\System\CurrentControlSet\Control\LSA
- Name: DisableRestrictedAdmin
- Type: REG_DWORD
- Value: 0
Does not require a reboot.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the process of using RDP Restricted Admin Mode?

A

Once it is enabled run the following command:

mstsc /v:$ServerName /RestrictedAdmin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How can you enforce all RDP connections to use Restricted Admin?

A
  1. GPO Managment
  2. Create/Edit GPO
  3. Computer Configuration \ Policies \ Administrative Templates \ System \ Credentials Delegation
  4. Configure “Restrict delegation of credentials to remote servers” to Enabled
  5. Gpupdate to apply the policy.

NOTE: This does NOT enable Restricted Admin mode on target systems, it only requires its use for RDP. Make sure it is turned on before configuring this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a good use case for RDP Restricted Admin?

A
  • Domain Admin needing to login to a member server to perform some task. RDP Restricted Admin would prevent DA credentials from landing on the member server in a way where they would be harvestable.
  • Help Desk staff who connect to workstations with T2 privileged accounts could use this so they wouldn’t expose their logons or need to change passwords as often.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

When RDP Restricted Admin is used to connect to one system and an attempt is made to RDP to another system, which credentials are used?

A

RDP Restricted Admin prevents your credentials from landing on the target system. Any connections outbound from that system will use the target computer account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What types of accounts are most at risk in Windows?

A
  • Privileged Accounts with broad privileges

- VIP Accounts (Executives, HR, etc.) who may have access to confidential resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is selective authentication?

A

Selective Authentication can be enabled on external forest trusts. It provides AD admins with more control over which groups of users in a trusted forest can access shared resources in the trusting forest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is Privileged Access Management?

A

PAM is a component of Microsoft Identity Manager (MIM) 2016 and is a solution that helps mitigate unauthorized privilege escalation attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

In which version of Windows was the optional feature “Privileged Access Management” introduced?

A

Server 2016 - Specifically the DCs must be Server 2016.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are PAM’s system requirements?

A
  • Management forest must be server 2012 R2 or newer with FFL of 2012 R2 or newer.
  • PAM client is supported for Windows 7+
  • Powershell 2.0 or greater is required for Powershell features
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are Shadow Principals?

A

Principals in the admin forest that bear the SIDs of administrative groups in the production forest (e.g. Domain Admins).

Users are added to shadow principals in the Admin forest and this is reflected in the production forest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is required on the trust between the Admin Forest and the production forest for PAM to work?

A

SID History must be enabled.

PIM trust must be enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Can an attacker enumerate the members of domain admins in the production forest if the forest is being managed with PAM?

A

No. Since the membership of the privileged groups is managed by the PAM forest, the groups in the production forest will never have any membership and thus cannot be enumerated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are the requirements for the Privileged Access Management Feature?

A
  • DCs must be Server 2016 or Newer
  • FFL/DFL must be Server 2012 R2 or newer
  • For integration with PAM forest
    • Forest trust between Prod and Admin forest (prod trusts admin)
    • Prod DCs must be Server 2012 R2 or newer with the May 2016 Update Rollup
    • TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL (sidHistory) is set on the trust.
    • TRUST_ATTRIBUTE_PIM_TRUST (enable PIM trust) is set on the forest
    • Optional feature “Privileged Access Managment” feature is enabled on the admin forest.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

How do you verify a trust can be configured with the PIM trust feature?

A

Run the command: netdom trust /?

If /EnablePIMTrust appears, it is available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Where are shadow principals stored?

A

They are stored in the admin forest under the “Shadow Principal Configuration” container under the Services container
CN=Shadow Principal Configuration,CN=Services,CN=Configuration,$DomainDN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the PAM Monitoring Service?

A

The PAM monitoring service is used to mirror the ACCOUNTDISABLE flag in UAC of sourced production accounts to their corresponding admin accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

When utilizing PAM you realize you are unable to effectively manage the well-known SID groups in the production forest. What could be the cause?

A

If the prod forest is Server 2012 R2, it is likely missing a patch that allows the /EnablePIMTrust attribute to be enabled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Can you have multiple approvers in PAM?

A

No. PAM only supports single approvers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What all information is replicated between the two forests using the PAM Monitoring Service?

A

Only the account enabled/disabled flag. All other information is not replicated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

You receive an error when you attempt to run New-PAMGroup. What could be the issue?

A
  • Ensure you are logged onto the PAM server, not a corporate workstation.
  • Ensure you have the MIMPAM Powershell module installed and enabled in your session.
48
Q

When running the New-PAMGroup cmdlet you receive an error “requestor’s identity is not found”. What do you do?

A

Ensure you are signed in as someone who has an account in MIM.

49
Q

What are the goals of Privileged Access Management?

A

Re-establish control over a compromised AD by maintaining a separate bastion forest that is known to be unaffected by the malicious attacks.

Isolate use of privileged accounts to reduce the risk of credentials being stolen.

50
Q

What different kinds of attacks can PAM help protect against?

A
  • Vulnerabilities
  • Unauthorized Privilege escalations
  • Pass-the-Hash
  • Pass-the-Ticket
  • Spear Phishing
  • Kerberos compromises
51
Q

What are the four steps of PAM setup and operation?

A
  1. Prepare - Identity which groups have privileges. Recreate these groups in the bastion forest.
  2. Protect - Setup lifecycle and authentication protection for when users require JIT administration.
  3. Operate - After request and approval, accounts get added temporarily to privileged groups in the bastion forest. They have these rights for a pre-set amount of time. After, they are removed.
  4. Monitor - Auditing, alerts, and reports of privileged access requests.
52
Q

How does Multi-Factor Authentication (MFA) play into PAM?

A

MFA helps prevent programmatic attacks from malicious software or following credential theft.

53
Q

How does the bastion forest limit the amount of time a user has permissions?

A

PAM depends on the time-limited group memberships which restrict a limited lifetime time-limited TGT.

54
Q

Which accounts need moved to the new secure forest?

A

Only privileged accounts. Regular accounts, machine accounts, etc. don’t need moved.

55
Q

What are some advantages of using Privileged Access Management?

A
  • Isolation/scoping of privileges - Users do not hold privileges on the accounts that are also used for non-privileged tasks. Privileges need requesting.
  • Setup and proof-up
  • Additional Logging
  • Customizable Workflows
56
Q

What different methods can users use to request access via Privileged Access Management?

A
  • MIM Services Web Services API
  • A REST Endpoint
    Windows Powershell (New-PamRequest)
57
Q

What is the best way to ensure a bastion forest is logically separated from the prod forest?

A
  • Servers should not be joined to the domain or leverage settings distribution from the existing prod environment.
  • Bastion forest should contain its own AD DS and the essential functions of that service itself (Kerb, LDAP, DNS, Time, etc.)
  • MIM should not use an existing SQL DB from production
  • Bastion forest requires Server 2016 or newer
  • Backups and media for bastion must be kept separate from backups and media of existing forests - prevents subversion of the bastion.
  • Management of bastion should take place from workstations not otherwise exposed to production.
58
Q

How should accounts be setup for the bastion forest?

A
  • Least privilege should be used where ever possible
  • Accounts in the admin forest that are used to administer production should not have permissions to the admin forest
  • Admin privileges over the admin forest should be controlled by an offline process
  • Admin forest should follow MS Security Compliance Manager configurations for the domain, including strong configurations for authentication protocols
59
Q

What are break glass accounts and how are they secured?

A

Break glass accounts are emergency accounts that are able to bypass many security restrictsion in case of an outage or incident to regain access to an environment. These accounts should be limited to logon only to systems they are configured on, nothing more.

60
Q

What are “Red Card Administrators” and how should they be secured?

A

Red Card Administrators provision other accounts and perform unscheduled maintenance. They should have no access to existing, non-admin forest systems outside the bastion environment. Their credentials, ideally a smart card, should be physically secured and use of the account logged and audited.

61
Q

What systems qualify as administrative hosts?

A
  • Desktops which the credentials of administrative accounts are typed or entered.
  • Administrative “jump” servers on which administrative sessions/tools are run.
  • All hosts where administrative actions are performed, including standard user desktops running RDP
  • Servers hosting apps that need to be administered and are not accessed via RDP with Restricted Admin mode or PS Remoting
62
Q

What considerations are needed when considering deploying administrative workstations (PAWs) for a bastion forest?

A
  • Verify the media build is clean
  • Use security baselines (Microsoft Security Compliance Manager)
  • Enable SecureBoot
  • Enable AppLocker (software restrictions)
  • Enable Full Volume Encryption (BitLocker)
  • Restrict USB
  • Network Isolation via Windows Firewall
  • Configure EMET (Exploit Mitigations)
  • Perform Attack Surface Analsysis
  • Administrative privileges should not be given to users on the systems.
  • RestrictedAdmin should be used for outgoing RDP sessions
63
Q

What cmdlets can be used to update trust relationships with the PAM forest in the event the AD topology changes?

A
  • Test-PAMTrust
  • Test-PAMDomainConfiguration
  • Remove-PAMTrust
  • Remove-PAMDomainConfiguration
64
Q

How do you enable RPC over TCP/IP for the Local Security Authority in the Bastion Forest?

A

GPO should be used with newer versions of Windows

Registry for older: HKLM:\System\CurrentControlSet\Control\LSA

  • TcpipClientSupport
  • Value: 1
65
Q

What are the three levels of the AD Administrative Tier Model?

A
  • Tier 0 - Servers and resources that have direct control over enterprise identities in the environment. Includes groups, accounts, or assets with direct control of AD.
  • Tier 1 - Control over enterprise servers and applications. Includes other server OSes, Cloud, and enterprise applications. Admins with T1 will have control over a large segment of the business
  • Tier 2 - Control of user workstations and devices
66
Q

How does the tier model help reduce chances of privilege escalation?

A

Tier model prevents privilege escalation by restricting what administrators can control and where they can log in.

67
Q

What kind of control restrictions are incorporated into the Tier Model?

A
  • Control is the same throughout the tier
  • Control to lower tiers is possible but only as needed
  • Control to higher tiers is restricted and blocked
68
Q

What are the responsibilities/restrictions of a T0 Admin?

A
  • Manage the identity store and small number of systems responsible for the identity store.
  • Manage and control assets at any level as required
  • Can logon interactively or access assets trusted at the T0 Level.
69
Q

What are the responsibilities/restrictions of a T1 Admin?

A
  • Manage enterprise servers, services, and apps.
  • Manage and control assets in T1 and T2
  • Can only access assets (via network logon) trusted at T1 or T0 levels
  • Can only interactively logon to T1 assets.
70
Q

What are the responsibilities/restrictions of a T2 Admin?

A
  • Manage enterprise end-user systems (desktops, laptops, printers, etc.).
  • Can only manage and control assets at T2 level
  • Can access any assets (via network logon) at any level
  • Can only interactively logon to assets trusted at T2 level.
71
Q

What are the logon restrictions of the Tier Model?

A
  • T0 Users are unable to login to devices at lower tiers
  • T1 users are unable to login to devices at lower tiers and may, if so needed, have logons to higher tiers.
  • T2 users are able to logon to devices at T2 and T1 if needed.
72
Q

What is the clean source principle?

A

Clean source requires all security dependencies to be as trustworthy as the object being secured.

73
Q

How does the Clean Source principle protect the environment?

A

Control is transitive. If I control asset C with asset B, then anything that has control over asset B has indirect control over asset C.

By ensuring the entire control chain is secured, I can ensure that I maintain the integrity of Asset C.

74
Q

How does the clean source principle apply to installation media?

A

To ensure that installation media is secured, you must ensure it has not been tampered with since it was released by the manufacturer. You should validate the software integrity of the install media throughout the cycle in which it is possessed.

75
Q

What are the methods of validating software as it applies to the Clean Source principle?

A
  • Software obtained from physical media is known to come from the manufacturer or a reputable source is considered valid.
  • Software obtained from the internet and validated with vendor-provided hashes is considered valid.
  • Software obtained from the internet and validated by downloading and comparing two independent copies are valid
    • Download on two hosts with no security relationship (not in the same domain or managed by the same tools) - preferably from separate internet connections.
    • Compare downloaded files using hashing utility.
76
Q

What are tools that can be used to generate hashes to ensure their integrity?

A
  • Certutil -hashfile $FileName

- Get-FileHash $FileName

77
Q

How does the clean source principle apply to architecture and design?

A

You should ensure that a system is not dependent on lower trust systems.

78
Q

What different architectural control relationships manifest in an enterprise?

A
  • ACLs
  • Group Memberships
  • Agents
  • Logon
79
Q

Why are logons a control relationship?

A

When a user logs into a system, they expose their credentials to that system thus putting any resources managed by that system under the account with logon rights.

80
Q

What are some of the operational standards that can be applied to an organization?

A
  • Servers and workstations should be joined to AD
  • All servers and workstations should use a current OS
  • All servers should have RDP RestrictedAdmin enabled
  • Smart cards should be used and issued to all administrators
  • The Builtin\Administrator account in each domain is considered an emergency access account.
  • An enterprise identity management solution should be implemented
  • LAPS should be deployed to servers and workstations
  • A privileged access management solution should be in place or being deployed.
  • Personnel should be assigned to monitor security alerts and respond to them.
  • The ability to rapidly apply Microsoft Update should be available.
  • Baseboard management controllers on servers will not be sued or adhere to strict security controls.
  • Administrator’s accounts for servers and workstations will be managed by Domain Admins
  • A CAB or another security authority is in place for approving AD changes.
81
Q

What are some operational standards that can be applied to Administrator enablement and accountability?

A
  • Administrators must be vetted via a background check and a skill check prior to assigning privileges
  • Administrative privileges should be reviewed periodically (quarterly) to determine which personnel have a legitimate need for administrative access.
  • Administrators should be receiving regular training on the their role, risks and vulnerabilities affecting their systems, and other specific practices specific to the organization.
82
Q

How should administrator accounts be provisioned and deprovisioned?

A

Administrative accounts must be approved by an approving authority

  • Admins should only gain access based on legitimate business need
  • Approval for privileges should not exceed six months

Administrative accounts should be deprovisioned if the following conditions apply

  • If there is a personnel change
  • If there is a role change

Disabled accounts should be deleted within 6 months and record of their deletion documented

All privileged account memberships should be reviewed monthly to ensure no unauthorized permissions have been granted.

83
Q

How should accounts be separated to manage the risk of credential exposure?

A

All personnel should have separate accounts for administrative functions that are distinct from user functions

84
Q

How often should Administrative Permissions be reviewed?

A

At least quarterly

85
Q

In general what guidelines should an administrator follow before logging into a system?

A
  • Primary support option should be used if possible
  • Secondary should only be used if primary is unavailable
  • Forbidden support methods should never be used.
  • No internet browsing or email from the administrative account, ever.
86
Q

What guidelines should a T0 Administrator follow when logging into a system?

A

Remote Server Support

  • Primary - Remote tools that use network logons (type 3)
  • Primary Interactive - Use RDP RestrictedAdmin or Standard RDP from a secure workstation

Physical Server Support
- When at the console, the accounts do not have any tool restrictions beyond forbidden tools.

87
Q

Why is protecting T0 critical?

A

T0 assets already have direct or indirect control over all assets. If an attack were to compromise a DC, for example, there is not a need for lateral movement or privilege escalation, they have access to the credential store (database) and can compromise from there.

88
Q

What guidlines sh ould a T1 Admin use when logging into T1 systems?

A

Remote Server Support

  • Primary - Remote tools using network logons (type 3)
  • Primary interactive - RDP Restricted admin from an admin workstation with an account that uses JIT
  • Secondary - Logon using local admin (LAPS)
  • Forbidden - Standard RDP
  • Forbidden - Using credentials while in session (Runas/share authentication) - This exposes credentials

Physical Server Support

  • Primary - Retrieve local admin password while using admin workstation
  • Forbidden - Using domain account via console
  • Forbidden - Using domain credentials while in session (RunAs)
89
Q

What guidelines should a T2 Admin use when logging into T2 systems?

A

Desk Side Support

  • Primary - Over-the-shoulder support is provided with no tools
  • Forbidden - Logging on with domain accounts is not allowed. Switch to a desk-side workstation if admin privileges are required

Remote User Support

  • Primary - Remote assist, screen share, etc.
  • Forbidden - Logging in with domain account administrative credentials is not allowed. Switch to workstation support if admin privileges are needed.

Workstation Support

  • Desk-Side
    • Primary - Retrieve LAPS password and use local admin
    • Forbidden - Logging in with domain accounts is not allowed
  • Remote
    • Primary - Use RDP Restricted Admin with JIT
    • Secondary - Use LAPS
    • Forbidden - Standard RDP
90
Q

What activities should never be performed from an admin workstation?

A

Internet browsing

Email Access

91
Q

How should service account and application passwords be protected?

A
  • Lock service account passwords in a physical safe
  • Ensure that only personnel trusted a tier above the account have access to the password.
  • Limit number of people with access to the passwords to a minimum to ensure accountability
  • Ensure all access is logged, tracked, and monitored by a disinterested party
92
Q

What kinds of authentication should be used with privileged accounts?

A

Administrative users should use smart cards for logins. Not passwords, except with break-glass accounts.

MFA should be used with all Cloud Admin Accounts.

93
Q

What is the main idea behind an Enhanced Security Administrative Environment (ESAE)?

A

Security controls that aren’t available to traditional flat forests are available to ESAE.

Accounts can be provisioned that are standard users in the ESAE forest but also privileged in the down-stream forests.

94
Q

What is the major draw back of ESAE forests?

A

Some applications are not compatible with being administered from a separate forest or over an external trust with selective authentication.

95
Q

What are the overall design considerations associated with ESAE forests?

A
  • Limited Scope
  • One-way Trusts with Select Authentication
  • Privileges and Hardening - Least Privilege
  • Workstation Hardening - PAWs
  • Server and DC Hardening - Clean source, last OS, Updates
  • Account Hardening - MFA, No NTLM
  • Detective Controls
96
Q

When discussing ESAE, what is meant by limited scope?

A

ESAE gains its power from limited access and a small attack surface. Any additional management functions and applications introduced to an ESAE forest increase the attack surface and limit the effectiveness of the forest.

97
Q

What kind of inter-forest trust model should be used with an ESAE Forest?

A

One-way trusts should be used between the production forest and the ESAE forest.

  • Trust can be either a domain or a forest trust
  • Some apps require a two-way trust, but generally the admin forest doesn’t need to trust the production forest.

Selective Authentication should be enabled for all trusts between the ESAE and production forests

  • Selective Auth restricts accounts that can login to production hosts
  • Selective Auth requires accounts be granted the “Allowed to Logon” right in the production forest.
98
Q

What steps can be taken with an ESAE forest to ensure privileges are secure and the domain is hardened?

A
  • Only admin forest accounts in Bulitin\Administrators should be able to administer the domain controllers and add users to BA
  • Alter default permissions in the schema to grant Builtin Admin’s GPO rights.
  • Accounts in the admin forest should only be able to manage the production forest, not the admin forest.
  • Any admin rights to the admin forest should be tightly locked down.
  • Admin forest should follow Security Compliance Baselines
  • Admin forest should use the SCB strong recommendations for authentication
  • Admin forest should automatically be updated with security updates
  • Only PAWs should be used as workstations in the Admin forest and should only be joined to the admin forest.
  • Detective controls should be designed to alert on anomalies.
99
Q

What steps should be taken for hardening servers in the ESAE forest?

A
  • Media should be validated via the clean source principle
  • Only the latest operating systems should be used
  • Hosts in admin forest should automatically update
  • Security Baselines should be used as starting configurations
  • Secure Boot should be enabled
  • Full Volume encryption should be used to protect against physical attacks.
  • USB restrictions should be in place in the Admin Forest
  • Network Isolation should be incorporated into the design of the admin with firewalls set to block incoming connections
  • Antimalware should be configured
  • Rune the Attack Surface Analyzer to determine which configurations may be at risk.
100
Q

What steps should be taken to harden accounts in an ESAE forest?

A
  • MFA should be used for all accounts in the Admin forest except the Builtin\Administrator
  • MFA protected accounts should be set to rotate their NTLM hash periodically.
101
Q

What groups are considered T0 Groups by default?

A 
Enterprise Admins
Domain Admins
Schema Admins
Builtin Admins
Account Operators
Backup Operators
Server Operators
Print Operators
Domain Controllers
Read-Only Domain Controllers
Group Policy Creator Owners
Cryptographic Owners
Distributed COM Users
Any other groups delegated access similar to the functions or greater than the functions of any of these groups
102
Q

What different types of logons expose credentials?

A

Interactive Logons (Console, RunAs, etc.)

Remote Interactive (RDP) - Failures do not transmit

NewtorkClearText (New-PSSession -Authetication CredSSP / New-PSSession -Credential cred)

Network+Interactive (PSExect with explicit)

Batch / Service

103
Q

What are the different logon types that show up in Windows logs?

A 
Interactive - Logon Type 2
Network - Logon Type 3
Batch - Logon Type 4
Service - Logon Type 5
NetworkClearText - Logon Type 8
NewCredentials - Logon Type 9
RemoteInteractive - Logon Type 10
104
Q

How is selective authentication used in a Bastion/ESAE forest?

A

Selective authentication allows for restricting logons (thus credential exposure) to only authorized hosts.

105
Q

How is it that dedicated administrative forests can be more secure over traditional forest architectures?

A

Dedicated administrative forests are allowed to have wider breadth of security measures due to their limited use case.

Furthermore, compromise of a down-level forest limits the compromise of the administrative forest.

106
Q

For an administrative forest to be most secure, how should the trust be setup between it, PRIV, and a Production forest, CORP?

A

Corp forest should trust PRIV Forest.

This trust is one-way with selective authentication. Two-way could be used but its not necessary in this scenario.

107
Q

Why is having a separate account for administering the domain and one for day-to-day work still not effective at preventing credential theft if you are an admin on the workstation?

A

If malware ends up on that system inadvertently, keystroke loggers and other malicious vectors may be used to capture credentials as they are put into the system.

108
Q

What are the different components of Privileged Access Management?

A
  • AD Management Forest
  • DNS
  • MIM Service
  • MIM Management Policy Rule (MPR)
  • MIM Portal
  • MIM Service Database
  • PAM Monitoring Service
  • PAM Component Service
  • PAM REST API
109
Q

Are there any restrictions or challenges to deploying PAM with Server 2012 R2?

A

PAM cannot be used for well-known SID Groups (DA, EA, etc.) across a Server 2012 R2 trust.

PAM requires Kerberos aware applications

PAM only supports a single approver, not mutliples

PAM monitoring service synchronizes whether the corp AD account is enabled or disabled out to privileged AD> The sAMAccountName, UPN, description, and other UAC flags are not synched.

110
Q

What can be done to lock down the MIMMonitor account?

A

“Logon on as a Service” on the PAM Server
“Deny access this computer from the network” on the PAM server
“Deny Logon Locally” on the PAM server
“Deny Logon as Batch Job” on the PAM server
“Deny Logon through RDP” on the PAM server

111
Q

What can be done to secure the MIMService account?

A

“Logon as a Service” on the PAM Server
“Deny access to this computer from the network” on the PAM Server
“Deny Logon Locally” on the PAM Server
“Deny Logon as a Batch Job” on the PAM Server
“Deny Logon through RDP” on the PAM Server

112
Q

What can be done to lock down the MIM SharePoint Account?

A

“Logon as Service” on the PAM Server

113
Q

What can be done to lock down the MIMComponent account?

A

“Logon as Service” on the PAM Server
“Deny Access to this computer from the network” on the PAM Server
“Deny Logon Locally” on the PAM Server
“Deny Logon as Batch Job” on the PAM Server
“Deny Logon through RDP” on the PAM Server

114
Q

What can be done to lock down the MIM SQLServer Account?

A

“Logon as Service” on the PAM Server

115
Q

Which product does Microsoft Identity Manager replace?

A

MIM replaces Forefront Identity Manager (FIM)

116
Q

What is Microsoft Identity Manager (MIM) used for?

A

MIM is used to manage users, credentials, policies, and access within an organization

MIM also adds hybrid experience, PAM capabilities, and support for new platforms.

117
Q

What are some common MIM scenarios?

A

Automatic identity and group provisioning based on business policy and workflow-driven provisioning

Integration of the contents of directories with HR systems and other sources of authority.

Synching identities between directories, databases, and on-premises applications through common APIs and protocols, MS delivered connectors, and partner-delivered connectors.

70-744 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions