CVA CVA Operating System & Host-Based Vulnerabilities 3

Question 1

What does DLL injection involve in the context of Windows host-based attacks?

Accepted Answer

Forcing a running process to load a malicious dynamic link library into its address space

Answer

Replacing a system DLL with a malicious version on disk

Answer

Injecting SQL code through a DLL interface in a database application

Answer

Compiling a DLL that contains a backdoor into a legitimate installer

Question 2

Which Windows command-line utility displays all running processes and can be used for host-based triage?

Accepted Answer

tasklist

Answer

ipconfig /all

Answer

netstat -b

Answer

whoami /priv

Question 3

What is the purpose of Windows User Account Control (UAC)?

Accepted Answer

To require explicit elevation approval before allowing administrative actions

Answer

To encrypt user home directories using BitLocker

Answer

To enforce password complexity policies for local accounts

Answer

To block unsigned drivers from being installed on the system

Question 4

Which post-exploitation technique involves hiding malicious code by executing it within the memory space of a legitimate process?

Accepted Answer

Process hollowing

Answer

Credential stuffing

Answer

SQL injection

Answer

ARP spoofing

Question 5

What is the primary goal of File Integrity Monitoring (FIM) on a host?

Accepted Answer

Detecting unauthorized changes to critical system files and configurations

Answer

Compressing files to reduce storage usage on the host

Answer

Encrypting sensitive files to prevent data exfiltration

Answer

Scheduling automated backups of user data

Question 6

What defines a zero-day vulnerability from a host security assessment perspective?

Accepted Answer

A previously unknown flaw with no available patch at the time of discovery or exploitation

Answer

A vulnerability that was patched within zero days of disclosure

Answer

A vulnerability that only exists in end-of-life operating systems

Answer

A misconfiguration that can be fixed in zero downtime

Question 7

Which Windows built-in tool allows a vulnerability assessor to query and analyze Windows Event Logs for suspicious host activity?

Accepted Answer

Eventvwr.msc (Event Viewer)

Answer

Regedit

Answer

Certmgr.msc

Answer

Gpedit.msc