Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

BootProcess > System Hardening, Auditing, and Logs > Flashcards

System Hardening, Auditing, and Logs Flashcards

1
Q

What does a firewall do

A

Blocks network traffic based on rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How to bring up the Windows Firewall GUI

A

wf.msc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Command in CMD to interact with Windows Firewall

A

netsh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cmdlet in Powershell to pull information about Windows Firewall

A

Get-NetFirewallRule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Windows Firewall Service Registry Path

A

HKLM\SYSTEM\CurrentControlSet\services\MpsSvc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Executable hosting the Windows Firewall Service

A

svchost.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Windows Firewall Service hosted DLL

A

mpssvc.dll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

3 Windows Firewall Profiles

A

Private, Public, Work/Domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How many profiles can be active on an interface at one time?

A

Multiple

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Windows Firewall Logging is configured where?

A

Within each profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NTFS

A

New Technology File System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Each file in NTFS has a what?

A

Security Descriptor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The Security Descriptor can include?

A

SID, DACL. SACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SID

A

Security Identifiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

DACL

A

Discretionary Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe what a SID is

A

A Security Identifier for the owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe a DACL

A

A Discretionary Access Control List that specifies the access rights (read,write,execute,delete) allowed or denied to particular users or groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SACL

A

System Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe a SACL

A

A system Access Control List that specifies the types of access attempts that generate audit records for the object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How to modify permissions within the GUI

A

Right Click -> Properties -> Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Command to modify permissions in CMD

A

icacls

22
Q

Command to modify permissions in Powershell

A

Get-Acl

23
Q

Sysinternals tool to modify permissions

A

accesschk

24
Q

WRP

A

Windows Resource Protection

25
Q

WFP

A

Windows File Protection

26
Q

Windows Resource Protection in XP

A

Windows File Protection (WFP)

27
Q

Windows File Protection (WFP) features

A

Watched for system file overwrite attempts
Checked file signature against known good
If bad, replaced with a copy from system32/dllcache folder

28
Q

Additional features of Windows Resource Protection (WRP)

A

Will keep protected files from being installed to begin with, rather than just overwriting them
Protected Resources can only be modified by Windows Module Installer service (TrustedInstaller.exe)
Can also protect system registry keys

29
Q

Executable for Windows Module Installer service

A

TrustedInstaller.exe

30
Q

Location where WRP Backups are stored

A

%Windir%\winsxs\Backup

31
Q

WRP Security Implications

A

Unable to overwrite protected files while Windows is running
Still able to mount drive into another OS and overwrite them
Look for drivers installed by 3rd Party to compromise
With Administrator privilege, can alter the configuration to allow modification

32
Q

UAC

A

User Account Control

33
Q

What does UAC do?

A

UAC limits the privileges of user run applications, even when run as Administrator, to prevent the modification of system files, resources, or settings. Requesting elevated privileges requires explicit acknowledgement from the user.

34
Q

Does UAC apply to all executables?

A

No, there are some Windows executables that can “auto elevate” without a prompt

35
Q

Waht kinds of files does WRP not protect?

A

pdf, doc,

36
Q

UIPI

A

User Interface Privilege Isolation

37
Q

Describe UIPI

A

UIPI is part of UAC

Each process is given a privilege level

38
Q

UIPI - Explain abilities of Higher integrity level

A

Higher integrity level can send messages to lower level integrity

39
Q

UIPI - Explain abiliteis of Lower integrity level

A

Lower integrity can only read Higher

40
Q

How can UIPI be bypassed?

A

Can be bypassed by signed and trusted applications with the UIaccess manifest setting

41
Q

IA

A

Information Assurance

42
Q

What is IA?

A

IS the practice of assuring information and managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes.

43
Q

IA protects what?

A

the Integrity, Availability, Authenticity, Non-Repudiation, and Confidentiality of user data

44
Q

Information Security goal

A

Preservation of Confidentiality, Integrity, and Availability of information

45
Q

CIA Triad

A

Confidentiality, Integrity, and Availability

46
Q

Information Security primary focus

A

Technical Security mechanisms

47
Q

Describe Host-based Security Products

A

Runs local on the machine, only concerned with that machine. OS dependent, version dependent. Some install as a service. Many new versions are cloud based.

48
Q

Types of Host-based Security Products

A 
System Firewalls
Process Monitoring, kernel calls
Directory Monitoring
System Setting/Registry monitoring
Log monitoring
Authentication, Authorization, Accounting (AAA)
Application Whitelisting
49
Q

Describe Network Security Products

A

Monitors traffic across the wire
Can be inline or passive
Inline often modifies traffic between destination and source

50
Q

Types Network Security Products

A 
Network Firewalls
Intrusion Detection System(IDS)
Intrusion Prevention System (IPS)
Web/Application Proxy
VPN Concentrator

BootProcess (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions