CVA CVA Operating System & Host-Based Vulnerabilities 3

Question 1

What does DLL injection involve in the context of Windows host-based attacks?

Accepted Answer

Forcing a running process to load a malicious dynamic link library into its address space

Answer

DLL injection forces a legitimate running process to load a malicious DLL, allowing the attacker to execute arbitrary code within the context of that trusted process.

Question 2

Which Windows command-line utility displays all running processes and can be used for host-based triage?

Accepted Answer

tasklist

Answer

The 'tasklist' command displays all currently running processes on a Windows system, including their PID and memory usage, making it useful for host-based incident triage.

Question 3

What is the purpose of Windows User Account Control (UAC)?

Accepted Answer

To require explicit elevation approval before allowing administrative actions

Answer

UAC prompts for confirmation or administrator credentials before allowing actions that require elevated privileges, limiting the impact of malware running in a standard user context.

Question 4

Which post-exploitation technique involves hiding malicious code by executing it within the memory space of a legitimate process?

Accepted Answer

Process hollowing

Answer

Process hollowing replaces the code of a legitimate process in memory with malicious code, allowing the attacker to evade detection while running under a trusted process name.

Question 5

What is the primary goal of File Integrity Monitoring (FIM) on a host?

Accepted Answer

Detecting unauthorized changes to critical system files and configurations

Answer

FIM tracks cryptographic hashes of critical files and alerts when unexpected modifications occur, helping detect malware, tampering, or unauthorized configuration changes.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Operating System & Host-Based Vulnerabilities 3