System & Endpoint Security Flashcards

Which Windows feature creates read-only snapshots of files that can help recover from ransomware if not deleted by the attacker?

Answer: Shadow Volume Copies (VSS)

Volume Shadow Copy Service (VSS) creates point-in-time snapshots of files, which ransomware often targets for deletion before encrypting data.

An analyst discovers an endpoint is beaconing to an external IP every 60 seconds. Which technique best describes this C2 communication pattern?

Answer: Periodic beaconing with a fixed sleep interval

Periodic beaconing with a fixed interval is a common C2 pattern where malware checks in at regular, predictable intervals.

Which Windows registry hive stores autorun entries that persist malware across reboots for the current user?

Answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKCU\Software\Microsoft\Windows\CurrentVersion\Run stores per-user autorun entries executed at login.

A security team wants to prevent attackers from dumping credentials from LSASS memory. Which Windows 10/11 mitigation should they enable?

Answer: Credential Guard using virtualization-based security

Credential Guard isolates LSASS secrets in a virtualization-based security enclave, preventing tools like Mimikatz from reading them.

Which file system artifact on Windows records the last 1,024 programs executed on a system and is invaluable for forensic investigations?

Answer: Prefetch files (.pf)

Windows Prefetch files store execution metadata for up to 1,024 applications to speed up subsequent launches and are a key forensic artifact.

A Linux system shows an unknown process with a deleted binary (shown as /proc//exe pointing to a deleted file). What does this indicate?

Answer: A fileless or in-memory malware technique to evade disk-based detection

Malware often deletes its binary after execution to remain resident only in memory, reducing its on-disk footprint and evading file-based AV scans.

Which endpoint detection capability specifically monitors and logs the sequence of parent-child process relationships to detect process injection?

Answer: Process lineage / process tree analysis

Process lineage tracking records parent-child relationships, revealing anomalies like Word spawning PowerShell, a common injection indicator.