CSCU Operating System Security 2 — Questions and Answers
Question 1: What is the principle of least privilege in operating system security?
- Giving all users administrator access for convenience
- Granting users and processes only the minimum permissions necessary to perform their required tasks (Correct answer)
- Removing all user accounts except one
- Disabling all security features for better performance
Correct answer: Granting users and processes only the minimum permissions necessary to perform their required tasks
The principle of least privilege limits each user, process, and application to only the access rights needed for their legitimate functions, minimizing the potential damage from compromised accounts or malicious software.
The principle of least privilege (PoLP) is a fundamental security concept requiring that every user, process, and application be granted only the minimum permissions necessary to perform its intended function—nothing more. In operating system security, this means regular users should not have administrator privileges, applications should only access the files and resources they need, and services should run with minimal system permissions. This limits the blast radius of security incidents: if a user account is compromised, the attacker inherits only limited permissions; if malware executes, it can only access resources available to the compromised account. Implementation includes using standard user accounts for daily work, employing sudo or UAC for temporary elevation, restricting file system permissions, and applying role-based access control (RBAC). Organizations that consistently apply PoLP significantly reduce their vulnerability to insider threats, privilege escalation attacks, and malware propagation.
Question 2: Why are operating system security patches important?
- They add new features and wallpapers
- They fix known vulnerabilities that attackers can exploit to compromise the system (Correct answer)
- They increase the operating system's storage capacity
- They improve the computer's physical appearance
Correct answer: They fix known vulnerabilities that attackers can exploit to compromise the system
Security patches fix discovered vulnerabilities in the operating system that, if left unpatched, provide known entry points for attackers to exploit for unauthorized access or malware installation.
Operating system security patches are updates released by vendors to fix discovered vulnerabilities in their software. These vulnerabilities—flaws in code that can be exploited by attackers—range from privilege escalation bugs that allow normal users to gain admin access, to remote code execution flaws that let attackers run malicious code without any user interaction. Once a vulnerability is publicly disclosed, attackers rapidly develop exploit code targeting unpatched systems. The WannaCry ransomware outbreak exploited a Windows vulnerability (EternalBlue) for which a patch had been available for two months—systems that hadn't applied the patch were devastated. Best practices include enabling automatic updates, applying critical patches within 48 hours of release, testing patches in a staging environment before production deployment in enterprise settings, and maintaining an inventory of all systems to ensure complete patch coverage.
Question 3: What is the purpose of User Account Control (UAC) in Windows?
- To track user browsing history
- To notify users and require confirmation before applications make system-level changes that could affect security (Correct answer)
- To control how many users can log in simultaneously
- To manage user interface color themes
Correct answer: To notify users and require confirmation before applications make system-level changes that could affect security
UAC prompts users for confirmation before allowing applications to make changes that require administrator privileges, preventing unauthorized software from silently making system-level modifications.
User Account Control (UAC) is a Windows security feature introduced in Vista and refined in subsequent versions. When an application or action requires administrator-level privileges—such as installing software, modifying system settings, changing registry entries, or accessing protected directories—UAC displays a consent prompt requiring explicit user approval. This prevents malware from silently gaining administrative access, even if the user is logged in with an administrator account. UAC works through access token splitting: even administrator accounts receive a standard user token by default, with the full administrator token only activated after UAC consent. While some users disable UAC due to prompt fatigue, this significantly weakens system security. Best practices include keeping UAC enabled, using standard user accounts for daily tasks, and paying attention to unexpected UAC prompts that may indicate malicious activity attempting to elevate privileges.
Question 4: What is full disk encryption and why is it recommended for operating system security?
- Compressing all files on the disk to save space
- Encrypting the entire contents of a storage drive so data is unreadable without the proper authentication credentials (Correct answer)
- Formatting the hard drive to remove old files
- Partitioning the drive into multiple sections
Correct answer: Encrypting the entire contents of a storage drive so data is unreadable without the proper authentication credentials
Full disk encryption protects all data on the drive by encrypting it, ensuring that if the device is lost, stolen, or the drive is removed, the data remains unreadable without proper authentication.
Full disk encryption (FDE) encrypts the entire contents of a storage drive—including the operating system, applications, temporary files, swap space, and user data—using strong cryptographic algorithms (typically AES-256). When FDE is active, all data written to the disk is automatically encrypted, and all data read from the disk is decrypted on-the-fly using a key derived from pre-boot authentication (password, PIN, TPM, or smart card). Windows provides BitLocker, macOS provides FileVault, and Linux offers LUKS for full disk encryption. FDE protects against physical threats: if a laptop is stolen, the drive is removed from a computer, or a device is disposed of, the encrypted data remains unreadable. Without FDE, anyone with physical access can read the drive by booting from external media or connecting it to another computer. FDE is especially critical for mobile devices and laptops that face higher theft risk.
Question 5: What is a host-based firewall and how does it differ from a network firewall?
- A host-based firewall is faster than a network firewall
- A host-based firewall runs on individual computers to filter traffic for that specific device, while a network firewall protects an entire network at its boundary (Correct answer)
- A host-based firewall only blocks outgoing traffic
- There is no difference between host-based and network firewalls
Correct answer: A host-based firewall runs on individual computers to filter traffic for that specific device, while a network firewall protects an entire network at its boundary
A host-based firewall runs on a single computer and controls incoming and outgoing network traffic for that specific device, providing protection even when the device is outside the network firewall's perimeter.
A host-based firewall is software that runs directly on an individual computer or device, monitoring and controlling network traffic to and from that specific host. Windows Firewall and macOS Application Firewall are built-in examples. A network firewall, in contrast, is typically a dedicated hardware appliance or virtual appliance positioned at the network perimeter, filtering traffic for all devices on the network. Host-based firewalls provide several advantages: they protect devices even outside the corporate network (laptops on public Wi-Fi), they can filter by application (allowing or blocking specific programs), they can apply per-user rules, and they provide defense-in-depth when used alongside network firewalls. In a zero-trust security model, host-based firewalls are essential because they enforce security at the endpoint regardless of network location. Best practice is to use both: a network firewall to protect the perimeter and host-based firewalls on each device for layered protection.
Question 6: Why should you avoid using an administrator account for daily computing tasks?
- Administrator accounts make the computer run slower
- Malware that runs under an administrator account gains full system access, while a standard account limits the damage malware can cause (Correct answer)
- Administrator accounts have fewer features
- Administrator accounts cannot access the internet
Correct answer: Malware that runs under an administrator account gains full system access, while a standard account limits the damage malware can cause
Using a standard account for daily tasks limits the damage that malware can inflict because it inherits the restricted permissions of the account, preventing system-wide changes without explicit elevation.
When you use an administrator account for daily computing, any program you run—including malware—operates with full administrator privileges. This means malware can install system services, modify boot records, disable security software, access all files on the system, create new admin accounts, and make changes that persist and survive removal attempts. In contrast, when using a standard (non-admin) account, malware inherits the limited permissions of that account. It cannot install system-wide software, modify protected system files, disable security services, or make persistent system changes without triggering a UAC prompt (on Windows) or password prompt (on macOS/Linux) that alerts the user. This simple practice—using a standard account for daily tasks and only elevating to admin when necessary—significantly reduces the impact of many attack vectors and is recommended by every major security framework.
CSCU Operating System Security 2
What is the principle of least privilege in operating system security?