Jcac Module 7 Windows 1

Front 1

The System call Handler is also referred to as?

Back 1

"The Executive"

Front 2

What ring does the Kernel Operate in?

What ring does the user operate in?

Back 2

Ring 0; Ring 3

Front 3

What is a program or an application?

Back 3

.exe; An executable software referred to as an executable image.

Front 4

What is a process?

Back 4

An executing instance of an application.

Front 5

What is an Application Programming Interface (API)?

Back 5

A interface for requesting OS services by using callable functions contained in libraries called DLL's. (Dynamic Link Libraries)

Front 6

What is a Dynamic Link Library?

Back 6

A set of callable functions and subroutines linked together as a binary file. Since DLLs cannot be executed individually, they need to be in the context of a process.

Front 7

What is the Native API?

Back 7

Used whenever a function needs a service from the Kernel, The Native API translates the request into the actual system call.

"He talks directly to the Kernel"

Front 8

What is the file name for the Native API?

Back 8

NTDLL.DLL

Front 9

What is the Hardware Abstraction Layer (HAL)?

Back 9

hal.dll; HAL is a kernel-loadable module that operates between hardware and the Executive so applications and device drive do not have to know hardware-specific information.

Front 10

What is Ntoskrnl.exe?

Back 10

This provides the kernel and executive when executed during start-up.

Front 11

The Kernel is object oriented and provides what 4 functions?

Back 11

Thread Scheduling; Interrupt and Exception Handling; Low-level Processor Synchronization: Power Failure Recovery.

Front 12

What is the "Executive"?

Back 12

The System Call Handler that verifies and provides kernel services.

Front 13

The Windows Executive consists of 8 things. They are?

Back 13

1. Object Manger

2.Process Manager

3.Virtual Memory Manager

4. I/O Manager

5. Security Reference Monitor

6. Local Procedure Call

7. PnP Manager

8.Configuration Manager

Front 14

What are the three main criteria of an object?

Back 14

1. An object is an instance of a statically defined class that exists in kernel mode.

2. An object is a system resource that two or more user mode processes can share.

3. Can have names, support synchronization and are protected by object-based security.

Front 15

What is a symbolic link?

Back 15

Objects used to refer to an object indirectly. They are often used to translate MS-DOS device names into Windows internal device names.

ex) C: to \Device\HarddiskVolume1

Front 16

What are the 2 types of ACLs contained in the security descriptor?

Back 16

1. Discretionary ACL (DACL) - Identifies Permissions to a resource.

2. System ACL (SACL) - Controls how the system audits object access attempts.

Front 17

Each object has what 2 parts?

Back 17

An object header and object body.

Front 18

The object manager is responsible for?

Back 18

Standardizing the interface with all objects by controlling the object header.

Front 19

What are methods?

Back 19

Methods are the actions or routines that their objects can perform.

Front 20

What are 6 major components of an Object Header?

Back 20

1. Object Name

2. Security Descriptor - Who can use the file and their permissions.

3. Open Handles Count - How many times the handle has been opened.

4. Open Handles List - List of processes that have opened this handle

5. Object Type - Lets you know who is in charge, and how to handle the file.

6. Reference count - Number of times a kernel mode component has referenced the address of this object.

Front 21

All user modes processes must own a __________ to an object before its __________ can use the object.

Back 21

handle; threads

Front 22

What is object retention?

Back 22

A way an object manager can determine if an object is in use or can be deleted. This is done by reference an objects Open Handle Count and Reference count.

Front 23

What two phases are used to implement object retention?

Back 23

Name retention - The number of open handles that exist to an object. When handles = 0, the name is deleted.

Object Deletion - When the reference count = 0, the kernel releases the object. Reference count and handle count must equal 0 in order for object to be deleted.

Front 24

What are the three way an object manager uses to build or assign a security descriptor?

Back 24

1. A subject that creates a new object and assigns information.

2. Object manager provides default security information.

3. Receives inherited information from a parent.

Front 25

What is the System Reference Monitor (SRM)?

Back 25

It enforces security policies that guard kernel mode resources by performing object access protections and auditing. It also generates most of the audit records in the Security event log.

Front 26

True or False. Security audits on most Windows systems are configured by default.

Back 26

False.

Front 27

Describe how a process receives access for a desired request.

Back 27

The SRM compares the process access token to the objects security descriptor list. If it matches up, access is permitted. The object manager then stores the access rights in the handle it creates.

Front 28

What resources does a process need in order to run...

"HEAP IT"

Back 28

Handle

Executable program; .exe

Access Token

Private address space

Identifier (PID)

Thread

Front 29

What does theWindows subsystem consist of?

Back 29

csrss.exe;

Win32k.sys;

kernel32.dll;

user32.dll;

gdi32.dll;

advapi32.dll

Front 30

What is the dll for the Native API?

Back 30

ntdll.dll;

Front 31

What does the Winlogon process do?

Back 31

Winlogon.exe handles user logons and logoffs; it also starts services.exe and lsass.exe.

Front 32

What does the session manager do and what is it's executable name?

Back 32

Session manager, or smss.exe, is the first user mode process to start. It creates system wide environment variables and starts winlogon.exe and csrss.exe.

Front 33

What is the Service Control Manager (SCM) and what is it responsible for?

Back 33

SCM, or services.exe is responsible for managing service processes.

Front 34

What is the Local System Authority (LSA) and what is it responsible for?

Back 34

LSA, or lsass.exe, uses authentication packages to verify user credentials. The SAM or Security Accounts manager can be found in here. Account information is maintained in an Active Directory in a domain environment.

Front 35

What is the purpose of explorer.exe?

Back 35

This manages the graphical interface for Windows.

Front 36

FAT, or File Allocation Table uses what to string together non-contingous data?

Back 36

linked allocation

Front 37

What are the timestamps associated with a FAT file?

Back 37

Created;

Accessed;

Written;

Front 38

What time stamps are associated with the NTFS, or New Technology File System?

Back 38

Creation;

Modified;

MFT Modified;

Accessed.

Front 39

Describe the Pre-Boot Sequence of the System Boot Process.

Back 39

The BIOS performs the POST. After the Post is completed, BIOS will load the MBR. After the active partition in the MBR is located, The MBR will load the Boot Sector from the system volume. The Boot Sector will then load NTLDR, also known as the Second Stage Boot Loader.

Front 40

Describe the Boot Sequence of the System Boot Process.

Back 40

The NTLDR will then switch the system from real to protected mode. The NTLDR will then read Boot.ini to determine which partition to boot. (Preferably the partition that contains the OS)

Then the NTLDR will load and execute NTdetect.com, which gets the list of hardware from the results of BIOS's POST.

Front 41

Describe the Kernel Load Sequence of the System Boot Process.

Back 41

NTLDR will then load Ntoskrnl.exe and Hal.dll. He loads the HKLM/System Registry key and starts all device drives that start with a hex value of 0x0. He lastly, passes control to ntoskrnl.exe.

Front 42

Describe the Kernel Initialization Sequence of the System Boot process.

Back 42

The kernel uses the information gathered from BIOS's POST to make the HKLM/Hardware registry key. HE also creates the HKLM/SYSTEM key and starts all drivers with the hex value of 0x0. He then starts the Session Manager process, smss.exe.

Front 43

Describe the User Mode Start-up portion of the System Boot Process.

Back 43

Smss.exe will start the subsystem csrss.exe and winlogon.exe. (as well as Win32k.sys and all the subsystem DLLs associated with it as covered in a previous flash card) Winlogon will then start the SCM (services.exe) and the LSA (lsass.exe) process and present the logon box.

Services will then load all services marked with a hex value of 0x2.

Front 44

What does each SCM Registry start value mean...

0x0?

0x1?

0x2?

0x3?

0x4?

Back 44

0x0; Boot service: Loaded by the NTLDR.

0x1; System: Loaded at kernel initialization.

0x2; Automatic: Loaded by the SCM.

0x3; Manual: Loaded by user or SCM as needed.

0x4; Disabled: Service should not be started.

Front 45

What is the purpose of the Net Start and Stop command?

Back 45

They can start and stop services locally.

Front 46

What is Sc.exe?

Back 46

It is a CLI that can manipulate service control configurations functions on local and remote systems. It can even create it's own service.

Front 47

What is the purpose of Psservice?

Back 47

PsService is an Service Control Program, or SCP, that can start, stop, view and suspend services. It can also change configuration with the command "setconfig"

Front 48

What is the definition of Windows Services?

Back 48

Mechanisms used by the OS for system managment and configuration. Windows services consist of service applications, SCPs and SCM.

Front 49

What attributes are used in the FAT file system?

What attributes are found in the NTFS file system?

Back 49

FAT = R,A,S,H.

NTFS = A,R,C,H,E,S

Front 50

What is the difference between a Paged and Non-paged pool?

Back 50

A paged pool is just a list of pages identifying sections of virtual memory that can be swapped into and out of physical memory. Non-paged pool is a list of pages identifying sections of virtual memory that have to reside in physical memory at all times.

Front 51

What is the purpose of a Virtual Address Descriptor(VAD)?

Back 51

To keep track of which virtual addresses have been allocated in a process' address space and which have not.

Front 52

What are the two primary functions of a Vitual Memory Manager (VMM)?

Back 52

1) To map a process' virtual memory and 2) swapping while running threads or when the system tries to use more memory than made available.

Front 53

What is an interruption?

Back 53

Typically triggered by I/O devices or hardware. It is asynchronous.

Front 54

What is an exception?

Back 54

Typically triggered by software. It is synchronous.

Front 55

What is the Trap Handler?

Back 55

A kernel module that processes interrupts and exception by transferring control to code that handles the condition.

Front 56

What is and Interrupt Request (IRQ)?

Back 56

Interrputs are referred to as IRQ. It's priority is definied by it's level or IRQL.

Front 57

What is the purpose of an .inf file?

Back 57

It is the link between a particular hardware device and the driver that assumes primary control of the device.

Front 58

How do you view the Registry?

Back 58

Regedit

Front 59

True or False; Hardware data is stored on the Hard Drive permanently.

Back 59

False; Hardware Data can change at anytime, so the information considered volatile, meaning the information is created everytime the system boots and is stored in memory.

Front 60

What is the purpose of the Local Procedure Call (LPC)?

Back 60

To pass messages and requests betweena client server process in a single machine.

Front 61

What is the Win32k.sys?

Back 61

It is the kernel mode of the Windows susbsystem and contains the graphics device interface.

Front 62

What do the following DLLs contain...

1. kernel32.dll?

Back 62

1. Contains code that gives programs access to system functions. ie, basic input/output, start/stopping processes and memory management.

Front 63

2. user32.dll?

Back 63

2. Contains basic functions such as window management, user input, text and allows programs to implement a GUI.

Front 64

3. gdi32.dll?

Back 64

3. enables programs and applications to use graphics and formatted text on the video display and printer.

Front 65

4. advapi32.dll?

Back 65

4. A part of an advanced API service library supporting numerous APIs including Security and Registry calls.

Front 66

The file System Structure can be broken down into five layers. They are?

Back 66

Filename, File System, Physical, Metadata and Data.

Front 67

What is the Master File Table (MFT)?

Back 67

Considered the heart of the file system, it is used to manage filename and metadata for the NTFS file system. It contains attribute entries for every file and directory on that file system.

Front 68

What does it mean for an attribute to be resident or non-resident?

Back 68

A resident attribute is stored completely within an MFT entry while and non-resident is stored outside of the MFT entry.

Front 69

What are the stages of the System Boot Process?

Back 69

Pre-Boot Sequence;

Boot Sequence;

Kernel Load Sequence;

Kernel Initialization Sequence;

User Mode Start-up.

Front 70

What are the timestamps for a FAT file system?

Back 70

Created, Accessed, Modified.

Front 71

What are the timestamps for NTFS?

Back 71

Created, Accessed, MFT modified, Modified (Written)

Front 72

What are the 2 data structures used in a FAT file system?

Back 72

Directory Entry and File allocation.

Front 73

What is included in a FAT Directory Entry?

Back 73

Filename, Starting cluster, Size, File Attributes (RASH)

Front 74

What data structures are used in NFTS?

Back 74

$INDEX_ROOT - DIrectories, Subdirectories and files contained in it.

$STANDARD_INFORMATION - Accurate timestamps and File attributes (ARCHES)

$FILE_NAME - File name, size and references the parent directory.

$DATA - Contains file data or pointer to that data.

Front 75

If file data in NTFS is non resident, how does it keep track of the information?

Back 75

By using VCN to LCN mapping which is contained in the $DATA header.

Front 76

What port does Kerberos use?

Back 76

Kerberos.dll, or Kerberos uses port 88.

Front 77

Describe the Kerberos process.

(DIsclaimer: This is the way that I would sum this up, so take it with a grain of salt)

Back 77

After receiver your credentials, kerberos.dll will send your information to the KDC or Domain controller. The Authentication server, that runs under the DC's LSA will then check your credentials against the Active Directory. The AD will then give its results to the AS (Authentication Service) and the AS will give you a TGT (Ticket Granting Ticket) proving you've been authorized. It will also encrypt this information while sending it using a hash from the kRbgtg as well as a SK (System Key) to be able to unlock and read this transmission. The TGT is stored in the Cache.

Front 78

Describe the Kerberos process (continued.)

Back 78

After you receive your TGT and the SK needed to decrypt it, you send this and the SK over to the TGS (Ticket Granting Service). The TGT proves that you have been authenticated, and it is making a valid request. The TGS will then return a ST (Service ticket) to the Workstations LSA. The LSA will then turn that ST to an access token to be used as requested. For logon, it would be return to msgina.dll to start the user's shell, otherwise known as explorer.exe

Front 79

What is LCN?

Back 79

Logical Cluster number - Tracks actual physical clusters on a Disk.

Front 80

What is VCN?

Back 80

Virtual Control Manager - Tracks how many clusters are required to store data.

Front 81

What is the Difference between a SACL and a DACL?

Back 81

SACL - Auditing - System

DACL - User permissions - Discretionary

Front 82

There can be an Empty and Null DACL. What do they both entail?

Back 82

Empty DACL - Gives access to noone.

Null DACL - Unconditional Access to everyone.

Front 83

What are the two types to access tokens

Back 83

Primary and Impersonation.

Front 84

True or False. When combining share permissions, the end result is always the Least Restrictive.

Back 84

True

Front 85

True or False. When combing NTFS permissions, The end result is the most restrictive.

Back 85

False; It's cumulative.

Front 86

True or False. When combining NTFS and Shared permissions, the effective permission is always the most restricted.

Back 86

True.

Front 87

True or False. Shared permissions are only effective when a file or folder is accessed over a network.

Back 87

True. NTFS permissions pertain to the local system.

Front 88

You have a folder made private to a user, but you need that user to view a file inside that folder. How can you resolve this issue.

Back 88

You can give him a pathway to that file specifically. Known as a UNC, or Universal Naming Convention.

Front 89

If Joe, is a user in a group Sales, and that group is denied access to a folder. How can you let Joe view a file in that folder.

Back 89

Change the group he is in. (DONT NUKE IT!)

Front 90

What are the shared permissions?

Back 90

Full Control, Read, Change and Deny.

Front 91

What's important to Remember about the Deny permission.

Back 91

It takes precedence over everything.

Front 92

What are the NTFS permissions.

Back 92

Full Control, Modify, Read&Execute, List Folder Contents, Read, Write, Special Permissions.

Front 93

What are the Special permissions?

Back 93

Take Ownership (important to remember that an owner can't be specified, just given the ability to take ownership) and Change Permission.

Front 94

ACLs are processed in a certain order for determining permissions. What is it?

Back 94

Explicit - Denied ACEs

Explicit - Inherited ACEs

Inherited - Denied ACEs

Inherited - Inherited ACEs

Front 95

What are the administrative shares?

Back 95

1. Drive Letter$ - Root directory for a drive

2. ADMIN$ - Resources used during Comp Admin.

3. IPC$ - Name pipes required for communication between computers and programs.

4. NETLOGON - required by all client computers that access Domain controllers.

5. SYSVOL - required resource on all domain controllers

Front 96

What is a secondary Logon?

Back 96

A secondary logon utilized the RunAS program and service to perform tasks without having to logon as the administrator account.

Front 97

What are the 4 SCPs?

Back 97

Services.msc, PsService, SC and Net start/stop.

Front 98

For type values what do the following values mean...

1. 0x10 (16)

2. 0x20 (32)

Back 98

1. A service that runs in a process by itself.

2. A service that shares a process.

Front 99

Define the following...

1. Key Distribution Center?

2. Authentication Service?

Back 99

1. KDC is usually the Domain Controller that maintains a databse. Provides two main services. Authentication service and Ticket Granting Service.

2. Constructs a a ticket made from pre-authentication data. This comes encrypted and sent with a Session Key to decrypt it.

Front 100

Define the following...

3. Ticket Granting Service

4. Ticket Granting Ticket

Back 100

3. Upon reception of the TGT, the TGS will then return a Service Ticket to use for the requested service. LSA will use to make an Access Token.

4. Ticket that enables AS to safely transport requestors' credentials to the TGS. Stored in Cache.

Front 101

5. Service Ticket?

6. krbtgt Account?

Back 101

5. Used to authenticate with requested services.

6. It is used to generate a long term key. When a TGT is generated, the password hash from the krbtgt is used as an encryption key. Since this is a symmetric key, the TGS can encrypt and decrypt using the same keys as anyone on the network.

Front 102

7. Session key?

Back 102

7. The session key is used to encrypt and decrypt messages between the client and KDC.

Front 103

What is the Native API?

Back 103

ntdll.dll

Front 104

What is the Process Manager responsible for?

Back 104

Creating and managing process threads.

Front 105

What is the Virtual Memory Manager responsible for?

Back 105

Provides address space for each process.

Front 106

What is the I/O manager responsible for?

Back 106

Processing all file and I/O requests

Front 107

What is the Security Reference Monitor responsible for?

Back 107

Enforcing local Security policy.

Front 108

What is the Local Procedure Call responsible for?

Back 108

Transferring messages between Server and Client on the same computer.

Front 109

What is the PNP Manager recponsible for?

Back 109

Determining which drivers need to be loaded to support a device and loading them.

Front 110

What is the Configuration Manager responsible for?

Back 110

Responsible for implementing and managin the registry.

Front 111

What are two methods of Shared Memory Protection?

Back 111

1. DEP (Data Execution Prevention)

2. Copy on Write

Front 112

RID Numbers and meanings...

1. 500

2. 501

3. 18

4. 19

5. 20

6. 1000+

Back 112

1. Administrator

2. Guest

3. Local System (Service Account)

4. Local Service

5. Network Service

6. Ordinary Users

Front 113

What are the 5 parts t an SID, in order?

Back 113

1. SID

2. Revision Level

3. Authority Value

4. Sub-Authority Value

5. Relative Identifier (RID)

Front 114

How you should approach with test?

Back 114

Approach it with confidence. You are here for a reason. Even if you don't believe it, you have paperwork that proves otherwise. Just relax and i'll see you in 7.2!