HDO Module 2

Question 1

Which file extension are commonly used for shared libraries in Unix-like systems?

Accepted Answer

.so

Question 2

What are pieces of code that can be loaded into the kernel to extend its functionality without rebooting the system?

Accepted Answer

Modules

Question 3

What is an example of a Host indicator for an IoC?

Accepted Answer

Registry Keys

Question 4

What would be an IoC of data exfiltration?

Accepted Answer

Increases in volume of database read

Question 5

What are notable databases within Windows OS?

Accepted Answer

Windows Registry, Microsoft ESENT, Active Directory

Question 6

What are two common IoC formats?

Accepted Answer

STIX, YARA

Question 7

What is an example of a windows module

Accepted Answer

Kernel-mode drivers

Question 8

What is Category 8 Event Category (Study event categories

Accepted Answer

Investigating Event

Question 9

What are key components for endpoint collection data for baselines?

Accepted Answer

System config data, Running processes, Installed software, File sys info

Question 10

What are core categories of IoCs?

Accepted Answer

Network Indicators, Host Indicators, Behavioral Indicators

Question 11

What is a baseline?

Accepted Answer

A set of standards or configurations for systems and networks

Question 12

What is WMIC?

Accepted Answer

A powerful tool for retrieving info from a windows host

Question 13

A windows default process that hosts windows services, allowing multiple services to run under a single process

Accepted Answer

svchost.exe

Question 14

Where can IoCs be found/observed?

Accepted Answer

Threat Intel Feeds, Security Software Logs, Behavioral Indicators

Question 15

What are files that create shortcut files when a user accesses files or applications

Accepted Answer

LNK files

Question 16

What is Run Level 2 in Linux environment?

Accepted Answer

Multi-user mode without networking (rarely used)

Question 17

Which is a windows firewall command that can be configured via command line

Accepted Answer

netsh

Question 18

Which are system enumeration tools?

Accepted Answer

Nmap, Powershell, WMIC, Native commands

Question 19

Firewalls, Routers, Proxys, Sensors, Physical security devices, and Anti-device tampering are Software

Accepted Answer

False

Question 20

In modern Linux distrubitons systemd has largely replaced SysV

Accepted Answer

True

Question 21

Which of the following are common TTPs?

Accepted Answer

Social Engineering, Malware Deployment, Lateral Movement, Data Exfil

Question 22

Will I study security event IDs?

Accepted Answer

Yes, Yes but in blue

Question 23

Powershell is cross platform

Accepted Answer

True

Question 24

What is Run Level 0?

Accepted Answer

Halt (shutdown system)

Question 25

User Mode Rootkits operate at OS's application layer

Accepted Answer

True

Question 26

What is nmap?

Accepted Answer

A free and open source utility for network discovery and security auditing

Question 27

Where is user account info stored in Linux systems?

Accepted Answer

/etc/passwd

Question 28

What type of baselining involves simple interviews to Mission Owners, users, and maintainers?

Accepted Answer

Informal Mission Mapping

Question 29

What are comparison methods we can use?

Accepted Answer

Compare-Object and vim -d

Question 30

Static Analysis is analyzing malware by executing it in a controlled environment

Accepted Answer

False

Question 31

What is an example of a Network indicator for an IoC?

Accepted Answer

IP address

Question 32

What is Run Level 5 in Linux environment?

Accepted Answer

Full multi user mode with networking and graphical interface (GUI)

Question 33

Which of the following are tools for detecting host based intrusions?

Accepted Answer

HIDS, EDR, XDR

Question 34

Which windows process is responsible for starting, stopping, and managing system services

Accepted Answer

services.exe

Question 35

Which command is used for nmap service version detection?

Accepted Answer

nmap -sV

Question 36

A glossary that classifies vulnerabilities

Accepted Answer

CVEs

Question 37

Event ID 4720 tells us a user account was created and helps us identify rogue accounts

Accepted Answer

True

Question 38

What is an example of a Behavioral indicator for an IoC?

Accepted Answer

Access patterns

Question 39

Detection, Analysis, and Mitigation is the lifecycle of IoCs

Accepted Answer

True

Question 40

Get-LocalUser is a command for which tool?

Accepted Answer

Powershell

Question 41

What is Ring 0 and Ring 3 in OS Protection Ring?

Accepted Answer

Ring 0 is Kernel Mode, Ring 3 is User Mode

Question 42

Which of the following are baseline components?

Accepted Answer

System config, Network config, User Accounts, Security policies, Logs

Question 43

What is Run Level 6 in Linux environment?

Accepted Answer

Reboot

Question 44

What are three components of a registry?

Accepted Answer

Hives, Keys, Values

Question 45

What are steps to create baseline of authorized application

Accepted Answer

Inventory/Identification, Define Approved Applications, Document Baseline

Question 46

What is an example of a linux module

Accepted Answer

Loadable Kernel Modules (LKMs)

Question 47

Kraken is an In-Band Capability

Accepted Answer

True

Question 48

A windows default process that manages windows graphical shell, including start menu, task bar, and file mgmt

Accepted Answer

explorer.exe

Question 49

What is Run Level 4 in Linux environment?

Accepted Answer

Undefined/User-defined (Customizable)

Question 50

What is Run Level 3 in Linux environment?

Accepted Answer

Full multi user mode with networking (text mode)

Question 51

Will I study the NIST Threat Intelligence Lifecycle?

Accepted Answer

Yes but in blue, Yes, Yes in yellow

Question 52

Task Critical Asset (TCA) are crticial assets which additional protections/active monitoring ensure mission objs are met

Accepted Answer

False

Question 53

Running instances of programs/applications

Accepted Answer

Process

Question 54

A target is a host identified for file collection to analyze.

Accepted Answer

True

Question 55

A technique used by attackers to run malicious code within address space of another process by injecting a DLL into it

Accepted Answer

DLL Injection

Question 56

How can you view windows logs?

Accepted Answer

Event Viewer, PowerShell, Kibana

Question 57

What are two important window artificats?

Accepted Answer

Windows Prefetch, LNK files

Question 58

How do we compare current state to baseline?

Accepted Answer

Conduct audits, Automated monitoring, Manual reviews

Question 59

Which artifact shows evidence that an executable was run on a system including first and last time of execution

Accepted Answer

Windows Prefetch

Question 60

What is the first process started by the kernel in Linux?

Accepted Answer

systemd, Init

Question 61

What Time Zone are event logs stored in?

Accepted Answer

UTC Time

Question 62

Kernel mode rootkits operate at kernel level and have direct access to core functions of OS

Accepted Answer

True

Question 63

Regular Expressions are foundational in cyber defense for their precision in pattern recognition across logs

Accepted Answer

True

Question 64

What is Run Level 1 in Linux environment?

Accepted Answer

Single-user mode

HDO Module 2

Questions 71

HDO Module 2

Questions 71