CNSP Exam Dumps and Practice Questions

The net command in Windows is a legacy tool for managing users, groups, and network resources. The subcommand net localgroup <groupname> displays information about a specified local group on the machine where it's run. Specifically:

net localgroup administrators lists all members (users and groups) of the local Administrators group on the current computer.

The local Administrators group grants elevated privileges (e.g., installing software, modifying system files) on that machine only, not domain-wide.

Output Example:

Alias name administrators

Comment Administrators have complete and unrestricted access to the computer

Members

-------------------------------------------------------------------------------

Administrator

Domain Admins

The command completed successfully.

Technical Details:

Local groups are stored in the Security Accounts Manager (SAM) database (e.g., C:\Windows\System32\config\SAM).

This differs from domain groups (e.g., Domain Admins), managed via Active Directory.

Security Implications: Enumerating local admins is a reconnaissance step in penetration testing (e.g., to escalate privileges). CNSP likely covers this command for auditing and securing Windows systems.

Why other options are incorrect:

A . List domain admin users for the current domain: This requires net group 'Domain Admins' /domain, which queries the domain controller, not the local SAM. net localgroup is strictly local.

Real-World Context: Attackers use this command post-compromise (e.g., via PsExec) to identify privilege escalation targets.

In Linux/Unix, file permissions are displayed in a 10-character string (e.g., -rwxr-xr-x), where the first character is the file type (- for regular files) and the next nine are permissions for user (owner), group, and others (rwx = read, write, execute). Special bits like SUID (Set User ID) modify execution behavior:

SUID: When set, a program runs with the owner's permissions (e.g., root) rather than the executor's. It's denoted by an s in the user execute position (replacing x if executable, or capitalized S if not).

Analysis:

-rwxr-sr-x (myfile): User: rwx, Group: r-s (SGID), Others: r-x. The s is in the group execute position, indicating SGID, not SUID.

-rwsr-xr-x (myprogram): User: rws (SUID), Group: r-x, Others: r-x. The s in the user execute position confirms SUID; owned by root, it runs as root.

-rw-r--r-s (anotherfile): User: rw-, Group: r--, Others: r-s. The s is in the others execute position, but no x exists, making it irrelevant (and not SUID). Typically, s here would be a sticky bit on directories, not files.

Security Implications: SUID binaries (e.g., /usr/bin/passwd) are common targets for privilege escalation if misconfigured (e.g., writable by non-root users). CNSP likely emphasizes auditing SUID permissions with find / -perm -u=s.

Why other options are incorrect:

A . myfile: Has SGID (s in group), not SUID.

C . anotherfile: The s doesn't indicate SUID; it's a misapplied bit without execute permission.

D . All of the above: Only myprogram has SUID.

Real-World Context: Exploiting SUID binaries is a classic Linux attack vector (e.g., CVE-2016-1247 for Nginx).

Kerberos is the default authentication protocol in Windows Active Directory environments, and tickets are used to prove identity. Verifying ticket validity involves checking their status, expiration, and attributes, which requires a built-in tool available in modern Windows systems.

Why A is correct: Klist is a command-line utility included in Windows (since Vista/2008) that lists cached Kerberos tickets and their details, such as validity period and renewal status. CNSP recognizes it as the standard tool for Kerberos ticket management in security audits.

Why other options are incorrect:

B: Kerbtray is a graphical tool from the Windows Resource Kit, not a built-in utility, and is outdated.

C: Netsh manages network configurations, not Kerberos tickets.

D: 'Kerberos Manager' is not a recognized built-in Windows utility; it's a fictitious name.

Social engineering exploits human psychology to manipulate individuals into divulging sensitive information, granting access, or performing actions that compromise security. Unlike technical exploits, it targets the 'human factor,' often bypassing technical defenses. The listed attacks fit this category:

Phishing: Mass, untargeted emails (e.g., fake bank alerts) trick users into entering credentials on spoofed sites. Uses tactics like urgency or trust (e.g., typosquatting domains).

Spear Phishing: Targeted phishing against specific individuals/organizations (e.g., CEO fraud), leveraging reconnaissance (e.g., LinkedIn data) for credibility.

Vishing (Voice Phishing): Phone-based attacks (e.g., fake tech support calls) extract info via verbal manipulation. Often spoofs caller ID.

Scareware: Fake alerts (e.g., ''Your PC is infected!'' pop-ups) scare users into installing malware or paying for bogus fixes. Exploits fear and urgency.

Watering Hole: Compromises trusted websites frequented by a target group (e.g., industry forums), infecting visitors via drive-by downloads. Relies on habitual trust.

Technical Details:

Delivery: Email (phishing), VoIP (vishing), web (watering hole/scareware).

Payloads: Credential theft, malware (e.g., trojans), or financial fraud.

Mitigation: User training, email filters (e.g., DMARC), endpoint protection.

Security Implications: Social engineering accounts for ~90% of breaches (e.g., Verizon DBIR 2023), as it exploits unpatchable human error. CNSP likely emphasizes awareness (e.g., phishing simulations) and layered defenses (e.g., MFA).

Why other options are incorrect:

A . Probes: Reconnaissance techniques (e.g., port scanning) to identify vulnerabilities, not manipulation-based like these attacks.

B . Insider threats: Malicious actions by authorized users (e.g., data theft by employees), not external human-targeting tactics.

D . Ransomware: A malware type (e.g., WannaCry) that encrypts data for ransom, not a manipulation method---though phishing often delivers it.

Real-World Context: The 2016 DNC hack used spear phishing to steal credentials, showing social engineering's potency.

A null session in Windows is an unauthenticated connection to certain administrative shares, historically used for system enumeration. The net use command connects to a share, and the IPC$ (Inter-Process Communication) share is the standard target for null sessions, allowing access without credentials when configured to permit it.

Why C is correct: The command net use \\hostname\ipc$ '' /u:'' specifies the IPC$ share and uses empty strings for the password (first '') and username (/u:''), establishing a null session. This syntax is correct for older Windows systems (e.g., XP or 2003) where null sessions were more permissive, a topic covered in CNSP for legacy system vulnerabilities.

Why other options are incorrect:

A: Targets the c$ share (not typically used for null sessions) and uses /u:NULL, which is invalid syntax; the username must be an empty string ('').

B: Targets c$ instead of ipc$, making it incorrect for null session establishment.

D: Uses ipc$ correctly but specifies /u:NULL, which is not the proper way to denote an empty username.