CVA CVA Operating System & Host-Based Vulnerabilities 2

Question 1

What is a pass-the-hash (PtH) attack?

Accepted Answer

Using a captured NTLM password hash to authenticate without knowing the plaintext password

Answer

In a pass-the-hash attack, an attacker uses a stolen NTLM hash to authenticate to a remote system without needing the actual plaintext password.

Question 2

Which tool is most commonly associated with extracting Windows credential hashes from memory during a penetration test?

Accepted Answer

Mimikatz

Answer

Mimikatz is a widely used post-exploitation tool that can extract plaintext passwords, hashes, and Kerberos tickets from Windows memory (LSASS process).

Question 3

What is the primary function of a Host-Based Intrusion Detection System (HIDS)?

Accepted Answer

Monitoring and analyzing activity on a single host for signs of compromise

Answer

A HIDS monitors system logs, file integrity, and process activity on a specific host to detect unauthorized changes or suspicious behavior indicative of a compromise.

Question 4

What type of vulnerability occurs when a program writes more data to a buffer than it was allocated to hold?

Accepted Answer

Buffer overflow

Answer

A buffer overflow occurs when excess data overwrites adjacent memory regions, potentially allowing attackers to overwrite return addresses or inject shellcode.

Question 5

Which Linux file stores hashed user passwords and is typically readable only by root?

Accepted Answer

/etc/shadow

Answer

The /etc/shadow file contains hashed passwords for user accounts and is restricted to root access, separating password hashes from the world-readable /etc/passwd file.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Operating System & Host-Based Vulnerabilities 2