Name:
Class:
Date:
Page 1
1. The MSBA tool can quickly identify missing patches and misconfigurations.
a.
True
b.
False
ANSWER:
True
2. Windows 10, Windows 8, Windows Server 2016, and Windows Server 2012 have most services and features
enabled by default.
a.
True
b.
False
ANSWER:
False
3. Windows Software Update Services (WSUS) is designed to manage patching and updating system software
from the network.
a.
True
b.
False
ANSWER:
True
4. Samba is a proprietary implementation of CIFS.
a.
True
b.
False
ANSWER:
False
5. Rootkits containing Trojan binary programs that are ready to install are more dangerous than typical Trojan
programs.
a.
True
b.
False
ANSWER:
True
6. Which of the following is an interprocess communication mechanism that allows a program running on one
host to run code on a remote host?
a.
RPC
b.
NetBIOS
c.
Winsock
d.
NetBEUI
ANSWER:
a
7. What critical component of any OS, that can be can be vulnerable to attacks, is used to store and manage
information?
a.
SQL database
b.
file system
c.
WSUS
d.
NetBIOS
Name:
Class:
Date:
Page 2
ANSWER:
b
8. To determine whether a system could be vulnerable to an RPC-related issue, which of the following tools can
be used?
a.
Nessus
b.
WSUS
c.
MBSA
d.
Unicornscan
ANSWER:
c
9. Early Windows OSs used which of the following programs loaded into memory to interact with a network
resource or device?
a.
Microsoft RPC
b.
IPX/SPX
c.
Winsock
d.
NetBIOS
ANSWER:
d
10. Which of the following protocols does NetBios use to access a network resource?
a.
TCP/IP
b.
NBT
c.
NetBT
d.
NetBEUI
ANSWER:
d
11. NetBios is not available in Windows Vista, Server 2008, and later versions of Windows. However, NetBios
should be understood by a security professional because it is used for which of the following?
a.
backward compatibility
b.
Windows upgrades
c.
virus scanning
d.
RPC
ANSWER:
a
12. NetBIOS over TCP/IP is called which of the following in Windows Server 2003?
a.
NBT
b.
NetBEUI
c.
NetBT
d.
NetTCP/IP
ANSWER:
c
13. SMB is used to share files and usually runs on top of NetBIOS, NetBEUI, or which of the following?
a.
Winsock
Name:
Class:
Date:
Page 3
b.
CIFS
c.
TCP/IP
d.
IPX/SPX
ANSWER:
c
14. What specific type of Windows Servers are used to authenticate user accounts and contain most of the
information that attackers want to access?
a.
SMB controllers
b.
domain controllers
c.
CIFS servers
d.
file servers
ANSWER:
b
15. Which standardized remote file system protocol replaced SMB in Windows 2000 Server and later?
a.
Common Internet File System
b.
Microsoft Knowledge System
c.
Windows Help File
d.
Windows On-line File System
ANSWER:
a
16. Microsoft Baseline Security Analyzer has its origins in which of the following command line scanners?
a.
MDAC
b.
HFNetChk
c.
MSXML
d.
Mbsacli
ANSWER:
b
17. Which of the following is a Window’s client/server technology designed to manage patching and updating
systems software from the network?
a.
AUS
b.
WSUS
c.
Automatic Update
d.
Patch Management Server
ANSWER:
b
18. Which of the following Window’s utilities includes a suite of tools to help administrators deploy and
manage servers and even allows for administrators to control mobile devices running Android, iOS, and
Windows Mobile OS?
a.
AUS
b.
WSUS
c.
SCCM
d.
SMS
Name:
Class:
Date:
Page 4
ANSWER:
c
19. Which of the following is an open-source implementation of CIFS?
a.
Samba
b.
GNUCIF
c.
GCIF
d.
OpenCIFS
ANSWER:
a
20. Red Hat and Fedora Linux use what command to update and manage their RPM packages?
a.
yum
b.
get
c.
dir
d.
apt-get
ANSWER:
a
21. For a Windows computer to be able to access a *nix resource, which of the following must be enabled on
both systems?
a.
NetBIOS
b.
SMB
c.
CIFS
d.
NetBEUI
ANSWER:
c
22. Ubuntu and Debian Linux use what command to update and manage their RPM packages?
a.
yum
b.
get
c.
dir
d.
apt-get
ANSWER:
d
23. Which of the following is a common Linux rootkit?
a.
Back Orifice
b.
Kill Trojans
c.
Packet Storm Security
d.
Linux Rootkit 5
ANSWER:
d
24. Which of the following is an SELinux OS security mechanism that enforces access rules based on privileges
for interactions between processes, files, and users?
a.
Mandatory Access Control
b.
SE Access Control
Name:
Class:
Date:
Page 5
c.
Access Control
d.
Mandatory Control
ANSWER:
a
25. What is the most serious shortcoming of Microsoft’s original File Allocation Table (FAT) file system?
a.
no ACL support
b.
no SUS support
c.
no SMTP support
d.
no Linux support
ANSWER:
a
26. What is the current file system that Windows utilizes that has strong security features?
a.
FAT
b.
ADS
c.
FAT32
d.
NTFS
ANSWER:
d
27. When using the Common Internet File System (CIFS), which security model will require network users to
have a user name and password to access a specific resource?
a.
NT level security
b.
Share-level security
c.
User-level security
d.
CIF level security
ANSWER:
c
28. Which of the following is considered to be the most critical SQL vulnerability?
a.
null SA hash
b.
null SA password
c.
SQL password
d.
SQL scanning
ANSWER:
b
29. When using the Common Internet File System (CIFS), which security model does not require a password to
be set for the file share?
a.
NT level security
b.
Share-level security
c.
User-level security
d.
CIF level security
ANSWER:
b
30. What programming languages are vulnerable to buffer overflow attacks?
Name:
Class:
Date:
a.
C and Python
b.
C and C++
c.
Assembly and C++
d.
Perl and Python
ANSWER:
b
31. What functions do most Trojan programs perform?
ANSWER:
Most Trojan programs perform one or more of the following functions:
– Allow remote administration of the attacked system
– Create a file server on the attacked computer so files can be loaded and downloaded without the user’s
knowledge
– Steal passwords from the attacked system and e-mail them to the attacker
– Log all keystrokes a user enters and e-mail the results to the attacker or store them in a hidden file the
attacker can access remotely
– Encrypt all of the user’s files and hold them ransom
– Destroy all of the data on a victim system
32. What is the purpose of a file system?
ANSWER:
The purpose of any file system, regardless of the OS, is to store and manage information. The file system
organizes information that users create as well as the OS files needed to boot the system, so the file system is
the most vital part of any OS. In some cases, this critical component of the OS can be a vulnerability.
33. What is Server Message Block (SMB) used for in Windows and can a hacker still damage a network using
SMB?
ANSWER:
In Windows, Server Message Block (SMB) is used to share files and usually runs on top of NetBIOS,
NetBEUI, or TCP/IP. Several hacking tools that target SMB can still cause damage to Windows networks.
Two well-known SMB hacking tools are L0phtcrack’s SMB Packet Capture utility and SMBRelay, which
intercept SMB traffic and collect user names and password hashes.
34. Why is NetBIOS still used in Windows Operating Systems?
ANSWER:
Systems running newer Windows OSs can share files and resources without using NetBIOS; however,
NetBIOS is still used for backward compatibility, which is important when corporate budgets don’t allow
upgrading every computer on the network. In addition, customer expectations must be met. Customers expect,
for example, that a document created in Word 97 can still be read in Word 2003. In fact, they demand it.
Therefore, software developers face the challenge of improving OS security yet still ensuring compatibility
with less secure predecessors.
35. What is the Common Internet File System (CIFS) protocol?
ANSWER:
Common Internet File System (CIFS) is a standardized protocol that replaced SMB in Windows 2000 Server
and later, but to allow backward compatibility, the original SMB is still used. CIFS is a remote file system
protocol that enables computers to share network resources over the Internet. In other words, files, folders,
printers, and other resources can be made available to users throughout a network. For sharing to occur, there
must be an infrastructure that allows placing these resources on the network and a method to control access to
resources.
Name:
Class:
Date:
with the word “color” in its description, he or she can use a GC server, which contains attributes such as the
resource’s name and location and points the user to the network resource.
37. What is Samba used for?
ANSWER:
Samba is an open-source implementation of CIFS; with Samba, *nix servers can share resources with
Windows clients, and Windows clients can access a *nix resource without realizing that the resource is on a
*nix computer. Samba has been ported to non-*nix systems, too, including OpenVMS, NetWare, and
AmigaOS. Samba is very useful because many companies have a mixed environment of Windows and *nix
systems.
38. What should a password policy include?
ANSWER:
A comprehensive password policy is critical, as a user name and password are often all that stands between an
attacker and access. A password policy should include the following:
– Change passwords regularly on system-level accounts
– Require users to change their passwords regularly
– Require a minimum password length of at least eight characters
– Require complex passwords
– Passwords can’t be common words, words found in the dictionary, or slang, jargon, or dialect
– Passwords must not be identified with a particular user
– Never write a password down or store it online or in a file on the user’s computer
– Don’t hint at or reveal a password to anyone over the phone, in e-mail, or in person
– Use caution when logging on to make sure no one sees you entering your password
– Limit reuse of old passwords
39. Why should you review logs regularly, and how should you manage this task?
ANSWER:
You should review logs regularly for signs of intrusion or other problems on the network. Scanning through
thousands of log entries is time consuming, and missing important entries is likely. A log-monitoring tool is
best for this task. Several are available, depending on network needs and budget.
40. Why should a systems administrator disable unused services and filtering ports?
ANSWER:
Disabling unneeded services and deleting unnecessary applications or scripts make sense because they give
intruders a potential point of entry into a network. If you have a Windows Server 2016 system acting as a file
server, you certainly don’t need DNS services running on it; doing so leaves port 53 TCP/UDP open and
vulnerable to attack. Open only what needs to be open, and close everything else.
Match each item with a statement below.
a.
attack surface
b.
Windows Software Update Services
c.
Systems Management Server
d.
Server Message Block
e.
NetBEUI
Mandatory Access Control
g.
Common Internet File System
Remote Procedure Call
Samba
Name:
Class:
Date:
Page 8
41. Amount of code a computer system exposes to unauthenticated outsiders
ANSWER:
a
42. A Windows client/server technology introduced in 2005 used to manage patching and updating system
software from the network
ANSWER:
b
43. Microsoft’s standard for managing Windows security patches on multiple computers in a network between
1994 and 2005
ANSWER:
c
44. Used to share files and usually runs on top of NetBIOS, NetBEUI, or TCP/IP
ANSWER:
d
45. A fast and efficient protocol that requires little configuration and allows transmitting NetBIOS packets over
TCP/IP
ANSWER:
e
46. An OS security mechanism that enforces access rules based on privileges for interactions between
processes, files, and users
ANSWER:
f
47. A standardized protocol that replaced SMB in Windows 2000 Server and later
ANSWER:
g
48. In 2007 became Windows new standard to deploy and manage servers alongside updated patch-
management functionality
ANSWER:
h
49. An interprocess communication mechanism that allows a program running on one host to run code on a
remote host
ANSWER:
i
50. An open-source implementation of CIFS
ANSWER:
j