What user account is required to create a Golden Ticket in Active Directory?
Answer(s): D
A Golden Ticket is a forged Kerberos Ticket-Granting Ticket (TGT) in Active Directory (AD), granting an attacker unrestricted access to domain resources by impersonating any user (e.g., with Domain Admin privileges). Kerberos, per RFC 4120, relies on the KRBTGT account--a built-in service account on every domain controller--to encrypt and sign TGTs. To forge a Golden Ticket, an attacker needs:The KRBTGT password hash (NTLM or Kerberos key), typically extracted from a domain controller's memory using tools like Mimikatz.Additional domain details (e.g., SID, domain name).Process:Compromise a domain controller (e.g., via privilege escalation). Extract the KRBTGT hash (e.g., lsadump::dcsync /user:krbtgt). Forge a TGT with arbitrary privileges using the hash (e.g., Mimikatz's kerberos::golden command). The KRBTGT account itself isn't "used" to create the ticket; its hash is the key ingredient. Unlike legitimate TGTs issued by the KDC, a Golden Ticket bypasses authentication checks, persisting until the KRBTGT password is reset (a rare event in most environments). CNSP likely highlights this as a high-severity AD attack vector.Why other options are incorrect:A . Local User account: Local accounts are machine-specific, lack domain privileges, and can't access the KRBTGT hash stored on domain controllers.B . Domain User account: A standard user has no inherent access to domain controller credentials or the KRBTGT hash without escalation.C . Service account: While service accounts may have elevated privileges, they don't automatically provide the KRBTGT hash unless compromised to domain admin level--still insufficient without targeting KRBTGT specifically.Real-World Context: The 2014 Sony Pictures hack leveraged Golden Tickets, emphasizing the need for KRBTGT hash rotation post-breach (a complex remediation step).
CNSP Official Study Guide (Active Directory Attacks); RFC 4120 (Kerberos), Microsoft AD Security Guidelines.
On a Microsoft Windows Operating System, what does the following command do? net localgroup administrators
Answer(s): B
The net command in Windows is a legacy tool for managing users, groups, and network resources. The subcommand net localgroup <groupname> displays information about a specified local group on the machine where it's run. Specifically:net localgroup administrators lists all members (users and groups) of the local Administrators group on the current computer.The local Administrators group grants elevated privileges (e.g., installing software, modifying system files) on that machine only, not domain-wide.Output Example:Alias name administratorsComment Administrators have complete and unrestricted access to the computer Members------------------------------------------------------------------------------- AdministratorDomain AdminsThe command completed successfully.Technical Details:Local groups are stored in the Security Accounts Manager (SAM) database (e.g.,C:\Windows\System32\config\SAM).This differs from domain groups (e.g., Domain Admins), managed via Active Directory. Security Implications: Enumerating local admins is a reconnaissance step in penetration testing (e.g., to escalate privileges). CNSP likely covers this command for auditing and securing Windows systems.Why other options are incorrect:A . List domain admin users for the current domain: This requires net group "Domain Admins" /domain, which queries the domain controller, not the local SAM. net localgroup is strictly local.Real-World Context: Attackers use this command post-compromise (e.g., via PsExec) to identify privilege escalation targets.
CNSP Official Documentation (Windows Security Commands); Microsoft Windows Command-Line Reference.
Which of the following files has the SUID permission set? -rwxr-sr-x 1 root root 4096 Jan 1 00:00 myfile-rwsr-xr-x 1 root root 4896 Jan 1 08:00 myprogram-rw-r--r-s 1 root root 4096 Jan 1 00:00 anotherfile
In Linux/Unix, file permissions are displayed in a 10-character string (e.g., -rwxr-xr-x), where the first character is the file type (- for regular files) and the next nine are permissions for user (owner), group, and others (rwx = read, write, execute). Special bits like SUID (Set User ID) modify execution behavior:SUID: When set, a program runs with the owner's permissions (e.g., root) rather than the executor's. It's denoted by an s in the user execute position (replacing x if executable, or capitalized S if not).Analysis:-rwxr-sr-x (myfile): User: rwx, Group: r-s (SGID), Others: r-x. The s is in the group execute position, indicating SGID, not SUID.-rwsr-xr-x (myprogram): User: rws (SUID), Group: r-x, Others: r-x. The s in the user execute position confirms SUID; owned by root, it runs as root.-rw-r--r-s (anotherfile): User: rw-, Group: r--, Others: r-s. The s is in the others execute position, but no x exists, making it irrelevant (and not SUID). Typically, s here would be a sticky bit on directories, not files.Security Implications: SUID binaries (e.g., /usr/bin/passwd) are common targets for privilege escalation if misconfigured (e.g., writable by non-root users). CNSP likely emphasizes auditing SUID permissions with find / -perm -u=s.Why other options are incorrect:A . myfile: Has SGID (s in group), not SUID.C . anotherfile: The s doesn't indicate SUID; it's a misapplied bit without execute permission.D . All of the above: Only myprogram has SUID.Real-World Context: Exploiting SUID binaries is a classic Linux attack vector (e.g., CVE-2016-1247 for Nginx).
CNSP Official Study Guide (Linux Permissions); Linux File System Documentation.
If a hash begins with $2a$, what hashing algorithm has been used?
Answer(s): A
The prefix $2a$ identifies the bcrypt hashing algorithm, which is based on the Blowfish symmetric encryption cipher (developed by Bruce Schneier). Bcrypt is purpose-built for password hashing, incorporating:Salt: A random string (e.g., 22 Base64 characters) to thwart rainbow table attacks. Work Factor: A cost parameter (e.g., $2a$10$ means 2^10 iterations), making it computationally expensive to brute-force.Format: $2a$[cost]$[salt][hash]Example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy $2a$: Bcrypt variant (original is $2$; $2a$ fixes a minor bug).$10$: 1024 iterations.Next 22 characters: Salt.Remaining: Hashed password.Used in /etc/shadow on Linux, bcrypt's adaptive nature ensures it remains secure as hardware improves. CNSP likely includes it in cryptography modules for its strength over older algorithms like MD5.Why other options are incorrect:B . SHA256: Part of the SHA-2 family, outputs a 64-character hexadecimal string (e.g., e3b0c442...), no $ prefix. It's faster, less suited for passwords.C . MD5: Produces a 32-character hex string (e.g., d41d8cd9...), no prefix. It's cryptographically broken (collisions found).D . SHA512: SHA-2 variant, 128-character hex (e.g., cf83e135...), no $ prefix, not salted by default. Real-World Context: Bcrypt protects SSH keys and web app passwords (e.g., in PHP's password_hash()).
CNSP Official Documentation (Cryptography); Bcrypt Specification, RFC 1321 (MD5).
Which of the following services use TCP protocol?
Answer(s): C
TCP (Transmission Control Protocol) ensures reliable, ordered data delivery via a connection-oriented handshake, contrasting with UDP's lightweight, connectionless approach. Analyzing each service:C . HTTP (Hypertext Transfer Protocol): Uses TCP (port 80) for web traffic. TCP's reliability ensures HTML, images, etc., arrive intact. HTTPS (TCP 443) extends this with TLS. RFC 2616 mandates TCP. A . SNMP (Simple Network Management Protocol): Defaults to UDP (port 161) for monitoring devices. UDP's speed suits its lightweight queries, though TCP variants exist (rarely used). B . NTP (Network Time Protocol): Uses UDP (port 123) per RFC 5905. UDP minimizes latency for time sync, tolerating occasional packet loss.D . IKE (Internet Key Exchange): Part of IPsec, uses UDP (port 500) per RFC 7296. UDP suits its negotiation phase; TCP isn't standard.Security Implications: TCP services like HTTP are more prone to state-based attacks (e.g., SYN floods) than UDP counterparts. CNSP likely contrasts TCP vs. UDP in protocol analysis.Why other options are incorrect:A, B, D: All default to UDP for efficiency, not TCP's reliability. Real-World Context: Firewalls prioritize TCP 80/443 rules for HTTP/HTTPS, while UDP 123 is opened for NTP servers.
CNSP Official Study Guide (Network Protocols); RFC 2616 (HTTP), RFC 1155 (SNMP).
Post your Comments and Discuss The SecOps Group CNSP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CNSP content, but please register or login to continue.