MOD D04: Windows Services - PE problems

Question 1

If a port is open, the service associated is able to be used.

[TRUE / FALSE]

Answer 1

TRUE

Question 2

What port is HTTP traffic associated with?

Answer 2

Port 80

Question 3

What port is SMTP traffic associated with?

Answer 3

Port 25

Question 4

What port is Webmail SSL traffic associated with?

Answer 4

Port 2096

Question 5

What port is SSH traffic associated with?

Answer 5

Port 22

Question 6

What port is IMAP traffic associated with?

Answer 6

Port 143

Question 7

What protocol is port 110 traffic associated with?

Answer 7

POP3 protocol

Question 8

What protocol is port 995 traffic associated with?

Answer 8

POP3s

Question 9

Service applications can be DLLs or executables.

[True / False]

Answer 9

TRUE

Question 10

What does SCP stand for, regarding Windows Services?

Answer 10

Service Control Program (SCP)

Question 11

What is the most common SCP?

Answer 11

The most common SCP is the services.msc GUI.

Question 12

Windows services typically run in the background.

[True / False]

Answer 12

TRUE

Question 13

The service panel is used to manage tasks.

[True / False]

Answer 13

FALSE

Question 14

If you need to change settings on a service when it fails, what tab in the service panel allows you to make changes to this?

Answer 14

Recovery tab

Question 15

If you wanted to access another machine remotely, which protocol would you use from the options below?

• HTTP
• SNMP
• HTTPS
• RDP

Answer 15

RDP

Question 16

What does RDP stand for?

Answer 16

Remote Desktop Protocol

Question 17

Where are authentication packages stored?

• DLL’s
• C:\
• the Kernel
• C:\Windows\System32\

Answer 17

DLLs

Question 18

What can adversaries modify to reveal credentials?

Answer 18

Auto start mechanism

Question 19

Local and Network Logon require the user to have an account in the SAM of that computer.

[True / False]

Answer 19

TRUE

Note: Both a local logon and a network logon require that the user has a user account in the Security Accounts Manager (SAM) on the local computer.

Question 20

What is the Network Service that resolves server names to IP addresses?

Answer 20

DNS

Question 21

What is the network service that provides secure transfer of web pages?

Answer 21

HTTPS

Question 22

What protocol used for the management and monitoring of network-connected devices?

Answer 22

SNMP

(Simple Network Management Protocol)

Question 23

POP3 and IMAP are protocols used with email technologies.

[True / False]

Answer 23

TRUE

Question 24

A network service is associated with a unique port number.

[True / False]

Answer 24

TRUE

Question 25

Only Microsoft provides services that run on Windows Server operating systems? [True / False]

Answer 25

FALSE

Question 26

The principle of "\_\_\_\_\_\_" states that a system should have no more capabilities that it requires to perform its intended purpose?

Answer 26

Least privilege

Answer 27

Least privilege

Question 28

What is a utility used by Windows to stop, start, and manage background services used by Windows and applications.

Answer 28

services.msc

Question 29

What is a software component that permits an operating system to communicate with hardware devices?

Answer 29

Driver

Question 30

A digitally signed driver shows that it is untrusted. [True / False]

Answer 30

FALSE

Question 31

When a service fails to start, typically an event is written to which log?

Answer 31

System

Question 32

Which of the following is the process of granting the user access only to the resources he or she is permitted to use?

Answer 32

Authorization

Question 33

Where is (are) most of the configurations for Windows stored?

Answer 33

Registry

Question 34

What command is used to start a service in Powershell?

Answer 34

start-service

Question 35

Which of the following items in Task Scheduler causes a task to run?

Answer 35

Trigger

Question 36

What is the authentication protocol used in a Windows domain environment to authenticate logons and grant accounts access to domain resources? * Putty * Hyper Text Transfer Protocol * Authentication * Kerberos

Answer 36

Kerberos

Question 37

Microsoft SBL is a database server. [True / False]

Answer 37

FALSE Note: Microsoft SQL is a DB server.

Question 38

Which process, typically a target of malware, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens?

Answer 38

Local Security Authority Server Service (LSASS)

Question 39

What service control manager handles all windows services?

Answer 39

services.exe