CVA Operating System & Host-Based Vulnerabilities Flashcards

What is privilege escalation in the context of operating system security?

Answer: Gaining higher-level permissions than originally granted to a user or process

Privilege escalation occurs when an attacker or process obtains higher-level permissions (e.g., root or SYSTEM) than initially granted, enabling broader system control.

Which Windows security feature marks memory regions as non-executable to help prevent code injection attacks?

Answer: Data Execution Prevention (DEP)

Data Execution Prevention (DEP) marks certain memory regions as non-executable, preventing attackers from running malicious code injected into data areas like the stack or heap.

What is the primary purpose of Address Space Layout Randomization (ASLR)?

Answer: To randomize memory addresses of key data areas, making exploitation harder

ASLR randomizes the memory addresses where system components (stack, heap, libraries) are loaded, making it difficult for attackers to predict target addresses for exploits.

Which Linux command is used to display currently running processes along with their resource usage?

Answer: top or ps aux

The 'top' command and 'ps aux' both display running processes with details such as PID, CPU, and memory usage, which are essential for host-based analysis.

What best describes a rootkit in the context of host-based vulnerabilities?

Answer: Malware designed to hide its presence and maintain persistent privileged access

A rootkit is malicious software that conceals its existence and that of other malware while maintaining persistent, often root-level access to a compromised system.

Which Linux configuration file defines which users and groups have sudo (superuser) privileges?

Answer: /etc/sudoers

The /etc/sudoers file controls which users and groups are permitted to run commands with elevated (sudo) privileges on a Linux system.

Which Windows registry hive stores machine-wide configuration settings applicable to all users?

Answer: HKEY_LOCAL_MACHINE (HKLM)

HKEY_LOCAL_MACHINE (HKLM) contains system-wide configuration settings including hardware, software, and security policies that apply to all users on the machine.