CVA CVA Operating System & Host-Based Vulnerabilities 1 — Questions and Answers
Question 1: What is privilege escalation in the context of operating system security?
- Encrypting files to prevent unauthorized access
- Gaining higher-level permissions than originally granted to a user or process (Correct answer)
- Patching a known OS vulnerability to close an attack surface
- Auditing user accounts to enforce least privilege
Correct answer: Gaining higher-level permissions than originally granted to a user or process
Privilege escalation occurs when an attacker or process obtains higher-level permissions (e.g., root or SYSTEM) than initially granted, enabling broader system control.
Question 2: Which Windows security feature marks memory regions as non-executable to help prevent code injection attacks?
- Address Space Layout Randomization (ASLR)
- Data Execution Prevention (DEP) (Correct answer)
- Control Flow Guard (CFG)
- Secure Boot
Correct answer: Data Execution Prevention (DEP)
Data Execution Prevention (DEP) marks certain memory regions as non-executable, preventing attackers from running malicious code injected into data areas like the stack or heap.
Question 3: What is the primary purpose of Address Space Layout Randomization (ASLR)?
- To encrypt sensitive data stored in RAM
- To randomize memory addresses of key data areas, making exploitation harder (Correct answer)
- To detect and remove rootkits from kernel memory
- To enforce access control lists on system files
Correct answer: To randomize memory addresses of key data areas, making exploitation harder
ASLR randomizes the memory addresses where system components (stack, heap, libraries) are loaded, making it difficult for attackers to predict target addresses for exploits.
Question 4: Which Linux command is used to display currently running processes along with their resource usage?
- netstat -an
- lsof -i
- top or ps aux (Correct answer)
- uname -a
Correct answer: top or ps aux
The 'top' command and 'ps aux' both display running processes with details such as PID, CPU, and memory usage, which are essential for host-based analysis.
Question 5: What best describes a rootkit in the context of host-based vulnerabilities?
- A script that automates software patch deployment
- Malware designed to hide its presence and maintain persistent privileged access (Correct answer)
- A tool used to scan for open ports on a target host
- An encrypted partition used to protect sensitive operating system files
Correct answer: Malware designed to hide its presence and maintain persistent privileged access
A rootkit is malicious software that conceals its existence and that of other malware while maintaining persistent, often root-level access to a compromised system.
Question 6: Which Linux configuration file defines which users and groups have sudo (superuser) privileges?
- /etc/passwd
- /etc/shadow
- /etc/sudoers (Correct answer)
- /etc/group
Correct answer: /etc/sudoers
The /etc/sudoers file controls which users and groups are permitted to run commands with elevated (sudo) privileges on a Linux system.
Question 7: Which Windows registry hive stores machine-wide configuration settings applicable to all users?
- HKEY_CURRENT_USER (HKCU)
- HKEY_LOCAL_MACHINE (HKLM) (Correct answer)
- HKEY_CLASSES_ROOT (HKCR)
- HKEY_USERS (HKU)
Correct answer: HKEY_LOCAL_MACHINE (HKLM)
HKEY_LOCAL_MACHINE (HKLM) contains system-wide configuration settings including hardware, software, and security policies that apply to all users on the machine.
CVA CVA Operating System & Host-Based Vulnerabilities 1
What is privilege escalation in the context of operating system security?