Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

1 Security and Quality and Risk > Windows Security > Flashcards

Windows Security Flashcards

(100 cards)

Start Studying
1
Q

What should build and test environments reflect?

A

Same security update levels (patches, service packs) as the user base.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does Microsoft recommend for security updates?

A

Install the latest patches and service packs immediately.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why is waiting to install patches not recommended?

A

Risk of zero-day exploits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What should developers determine about app resources?

A

Resources used and privileged APIs called to assess admin privilege needs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the Secure Development Lifecycle (SDL)?

A

A process aligning security-focused activities with software development phases.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What activities are part of SDL?

A

Developing threat models, using code scanning tools, conducting code reviews, security testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the principle of least possible privilege?

A

Build apps with minimal privileges to reduce system compromise risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why is least privilege important?

A

Reduces risk of intrusion from apps calling privileged functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What risk do apps with special privileges pose?

A

May leave the system open to intrusion if run longer than necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How should apps requiring special privileges be managed?

A

Run for the least time possible and inform users of security risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How can apps run with less risk of admin privileges?

A

Use a less privileged account, break into separate functions, authenticate users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What function authenticates users for admin privileges?

A

CredUIPromptforCredentials (CUI) or CredUICmdLinePromptforCredentials (cli).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does PrivilegeCheck do?

A

Determines which privileges are enabled in an access token.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When is PrivilegeCheck typically used?

A

By server apps to check privileges of a client’s access token.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What happens if privileges are insufficient?

A

Prompt user to log on with an account having sufficient privileges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are privileges in Windows?

A

Rights to perform system tasks like shutdown or changing system time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do privileges differ from access rights?

A

Privileges control system tasks; access rights control securable objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Who assigns privileges in Windows?

A

Administrators, to user and group accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What controls access to securable objects?

A

The object’s discretionary access control list (DACL).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is an impersonation token?

A

An access token capturing a client’s security info for a server to impersonate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is an access token?

A

A structure identifying a user’s security info, created at logon.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does an access token contain?

A

User’s identity, group memberships, and privileges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the types of access tokens?

A

Primary and impersonation tokens.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Who creates a primary token?

A

Windows kernel, for a process’s default security info.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is the minimum OS for PrivilegeCheck?
Windows 2000 (client or server).
26
What header file is needed for PrivilegeCheck?
winbase.h (included in windows.h).
27
What does PrivilegeCheck check?
Only enabled privileges in an access token.
28
How can privileges be enabled or disabled?
Using the AdjustTokenPrivileges function.
29
What are Windows objects in security terms?
COM-like objects with security descriptors defining access rights.
30
What is a security descriptor?
A structure specifying the rights needed to access an object.
31
What does a user’s access token provide?
Rights and group memberships for accessing objects.
32
What is a Security Identifier (SID)?
A unique account number identifying a user or group across the network.
33
What does a SID in an access token include?
References to group SIDs the user belongs to.
34
How is an access token modified?
Using Local Users and Groups or Active Directory Users and Computers MMC.
35
What does an access token’s privilege entry contain?
A locally unique identifier (LUID) and an attribute mask of rights.
36
What is a group SID entry?
Contains a privilege count and an array of privilege entries.
37
Who can own a Windows object?
A user or group, identified by a SID.
38
What controls Windows auditing?
The security access control list (SACL).
39
What controls object reuse in Windows?
The discretionary access control list (DACL).
40
What are absolute security descriptors?
Contain a copy of each ACL within their structure.
41
What are self-relative security descriptors?
Contain pointers to SACL and DACL, saving memory.
42
Why avoid manipulating ACL or SID contents?
Structures may change in future Windows updates.
43
What is a zero-day exploit?
A vulnerability exploited before a patch is available.
44
Why test environments need identical patches?
To mirror user base security and avoid discrepancies.
45
What is a privileged API?
An API requiring special permissions to execute.
46
Why break apps into separate functions?
Isolates admin-privileged functions, reducing overall risk.
47
What does CredUIPromptforCredentials do?
Prompts users for username and password for authentication.
48
What is the role of an access token in processes?
Every process uses a copy to define user permissions.
49
What is a locally unique identifier (LUID)?
A pointer to a privilege entry in an access token.
50
What tasks require special privileges?
System shutdown, loading drivers, changing system time.
51
How does the system use DACLs?
Grants or denies access based on an object’s DACL.
52
What is the purpose of an impersonation token?
Allows a server to perform security operations as the client.
53
What OS versions support PrivilegeCheck?
Windows 2000 and later, client or server.
54
What happens to disabled privileges?
PrivilegeCheck ignores them; they must be enabled via AdjustTokenPrivileges.
55
What are securable objects in Windows?
Resources like files or registry keys protected by security descriptors.
56
How does a user access a Windows object?
Presents an access token, which the system checks against the object’s security descriptor.
57
What does a group SID indicate?
The groups a user belongs to, included in the access token.
58
How are SACL and DACL used together?
SACL controls auditing; DACL controls access and reuse.
59
Why are self-relative descriptors memory-efficient?
Use pointers to ACLs instead of copying them.
60
What is the risk of running apps with admin privileges?
Increases vulnerability to system compromise.
61
Why inform users of security risks?
Transparency about potential vulnerabilities in privileged apps.
62
What is the Windows kernel’s role in tokens?
Creates primary tokens for processes.
63
What is the attribute mask in a privilege entry?
Defines the specific rights a user has to an object.
64
Why is PrivilegeCheck server-focused?
Typically used to verify client privileges in server-client interactions.
65
What is the difference between primary and impersonation tokens?
Primary is for process default security; impersonation is for client impersonation.
66
How does Windows handle group privileges?
Assigns them via group SIDs in the user’s access token.
67
What is the role of Active Directory in tokens?
Manages user and group SIDs for access token updates.
68
Why is SDL critical for secure coding?
Embeds security practices throughout development phases.
69
What is a threat model in SDL?
A model identifying potential security threats to an application.
70
What do code scanning tools do in SDL?
Detect vulnerabilities in code during development.
71
Why conduct code reviews in SDL?
Identify security flaws missed by automated tools.
72
What is security testing in SDL?
Verifying an app’s resistance to attacks and vulnerabilities.
73
Why minimize app runtime with privileges?
Reduces the window for potential intrusions.
74
What is the benefit of running under less privilege?
Lowers the risk of unauthorized system access.
75
How does PrivilegeCheck enhance security?
Ensures only necessary privileges are used for tasks.
76
What is a security risk of special privilege functions?
May expose the system to exploits if misused.
77
Why use impersonation in apps?
Allows secure execution of tasks as a specific user.
78
What does an access token’s privilege count indicate?
The number of privilege entries in the token.
79
How does Windows auditing work?
Tracks access and actions via the SACL.
80
Why are absolute descriptors less efficient?
Copy ACLs, increasing memory usage.
81
What is the purpose of a security descriptor?
Defines access rights for a securable object.
82
Why is an access token created at logon?
To establish a user’s security context for all processes.
83
What is the role of group SIDs in access tokens?
Indicate group memberships affecting user privileges.
84
How does DACL affect object access?
Specifies which users or groups can access an object.
85
What is the risk of not patching immediately?
Exposure to zero-day exploits before vulnerabilities are fixed.
86
Why align test environments with user base?
Ensures consistent security behavior in development and production.
87
What is the benefit of breaking apps into functions?
Isolates high-risk privileged operations from others.
88
How does CredUICmdLinePromptforCredentials work?
Prompts for credentials via command line for authentication.
89
What is the difference between SACL and DACL?
SACL tracks auditing; DACL controls access permissions.
90
Why is PrivilegeCheck dependent on enabled privileges?
Only enabled privileges are active for security checks.
91
What is a COM object in Windows security?
An object with a security descriptor controlling access.
92
How does a SID function across a network?
Uniquely identifies users or groups for consistent access control.
93
What is the MMC used for in security?
Manages user and group accounts to update access tokens.
94
Why avoid direct ACL manipulation?
Risks incompatibility with future Windows updates.
95
What is the benefit of self-relative descriptors?
Saves memory and simplifies group rights changes.
96
How does AdjustTokenPrivileges enhance security?
Allows dynamic enabling/disabling of privileges as needed.
97
What is the role of a security descriptor in access?
Specifies the rights required to interact with an object.
98
Why is an impersonation token temporary?
Used only for specific security operations by a server.
99
What is the significance of a user’s SID?
Ensures consistent identification across network resources.
100
How does Windows verify object access?
Compares the user’s access token with the object’s security descriptor.

1 Security and Quality and Risk (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions