Networks, Linux and Systems: The Technical Foundations of Cybersecurity Quiz

Quiz: Windows and Active Directory

Pass mark: 70%. You can retry as many times as you need.

1 Why do persistence mechanisms such as the 'Run' registry keys interest both attackers and defenders? Single answer They store passwords in clear text. They record every failed login. They encrypt the disk. They start programs automatically at login, so they are a place to hide or to find persistence.

2 In an Active Directory environment, what is the role of a domain controller? Single answer It hosts the directory and authenticates users and computers of the domain. It routes traffic between VLANs. It only stores the users' documents. It translates names to IP addresses for the Internet.

3 Which statements about Group Policy (GPO) are correct? (several answers) Multiple answers possible They can enforce password rules, firewall settings and audit policies across many machines. They only apply to one computer at a time. They are linked to a domain or to an OU. Compromising GPO management would let an attacker push changes widely.

4 In PowerShell, what is the main difference with a bash pipeline? Single answer PowerShell cannot use pipes. PowerShell only runs on domain controllers. The pipeline passes objects with properties, not just text. PowerShell scripts are always executed without restriction.

5 You examine a Windows server and find event 1102 in the Security log, shortly after a series of 4625 events and a 4720 event. What are reasonable conclusions and actions? (several answers) Multiple answers possible The sequence is suspicious and deserves an investigation. It is a routine event that can be ignored. Check centralised log copies and review the account created by event 4720. Event 1102 means a new service was installed.