Latest Exam Prep

Symmetric encryption is a cryptographic technique where the same key is used for both encryption and decryption processes. In the context of network security, when data is encrypted prior to transmission and decrypted at the receiving end using a symmetric encryption algorithm (e.g., AES or Triple-DES), both the sender and receiver must share and utilize an identical secret key. This key is applied by the sender to transform plaintext into ciphertext and by the receiver to reverse the process, recovering the original plaintext. The efficiency of symmetric encryption makes it ideal for securing large volumes of data transmitted over networks, provided the key is securely distributed and managed.
Why A is correct: Option A accurately describes the fundamental property of symmetric encryption-using a single shared key for both encryption and decryption. This aligns with CNSP documentation, which emphasizes symmetric encryption’s role in securing data in transit (e.g., via VPNs or secure file transfers).
Why other options are incorrect:
B: This describes asymmetric encryption (e.g., RSA), where different keys (public and private) are used for encryption and decryption, not symmetric encryption.
C: Symmetric encryption inherently relies on keys; the absence of keys contradicts its definition and operational mechanism.
D: Symmetric encryption is not inherently insecure; its security depends on key strength and management practices, not the algorithm itself. CNSP highlights that algorithms like AES are widely regarded as secure when implemented correctly.

The net localgroup command manages local group memberships on Windows systems, with syntax dictating its action.
Why B is correct: net localgroup Sales Sales_domain /add adds the domain group Sales_domain to the local group Sales, granting its members local group privileges. CNSP covers this for privilege escalation testing.
Why other options are incorrect:
A: Displaying users requires net localgroup Sales without /add.
C: Adding a user requires a username, not a group name like Sales_domain.
D: The reverse (local to domain) uses net group, not net localgroup.

SNMP community strings authenticate access, with defaults posing security risks if unchanged.
Why C is correct:
A: “public” is the standard read-only default, per SNMP specs and CNSP.
B: “private” is the standard read-write default, also per SNMP and CNSP.
Both are true, making C the answer.
Why other options are incorrect:
1, 2: Exclude one true statement each.
4: Both statements are true, so “none” is wrong.

In Linux, file visibility is determined by naming conventions, impacting how files are listed or accessed in the file system.
Why D is correct: “Dotfiles” are files or directories with names starting with a dot (e.g., .bashrc), making them hidden by default in directory listings (e.g., ls requires -a to show them). They are commonly used for user configuration, as per CNSP’s Linux security overview.
Why other options are incorrect:
A: Library files (e.g., in /lib) aren’t inherently hidden.
B: Driver files (e.g., kernel modules in /lib/modules) aren’t dotfiles by convention.
C: System files may or may not be hidden; “dotfiles” specifically denotes hidden status.

An IPv6 address, defined in RFC 4291, is a 128-bit address designed to replace IPv4’s 32-bit scheme, vastly expanding address space (2^128 vs. 2^32). An octet is 8 bits (1 byte). To calculate octets in IPv6:
128 bits ÷ 8 bits/octet = 16 octets.
Representation:
IPv6 is written as eight 16-bit hexadecimal blocks (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334), separated by colons.
Each block is 16 bits (2 bytes), so 8 blocks = 16 octets.
Contrast with IPv4 (e.g., 192.168.0.1), which has 4 octets (32 bits).
Technical Note: Your original input flagged this question’s phrasing as potentially misleading, suggesting “octets” is an IPv4 term, while IPv6 uses “16-bit groups” or “hextets.” While technically accurate (RFC 4291 uses “16-bit blocks”), “octets” remains a common, if informal, term in security contexts for byte-wise analysis (e.g., packet crafting). CNSP might use “octets” to test byte-level understanding, though “groups” is more precise for IPv6. Here, 16 octets (128 bits) is correct either way.
Security Implications: IPv6’s larger address space complicates scanning (e.g., Nmap struggles with 2^128 possibilities) but introduces risks like misconfigured Neighbor Discovery Protocol (NDP). Understanding its structure aids in firewall rules and IDS signatures.
Why other options are incorrect:
B . 32: Implies 256 bits (32 × 8), far exceeding IPv6’s 128-bit design.
C . 64: Suggests 512 bits (64 × 8), unrelated to IPv6 or any IP standard.
D . 128: Misinterprets octets as bits; 128 bits = 16 octets, not 128 octets.
Real-World Context: IPv6 packet analysis (e.g., Wireshark) breaks addresses into 16 octets for raw data inspection.

The Windows Registry is a hierarchical database storing configuration settings for the operating system, applications, and hardware. It’s physically stored as hive files on disk, located in the directory C:\Windows\System32\Config. These files are loaded into memory at boot time and managed by the Windows kernel. Key hive files include:
SYSTEM: Contains hardware and system configuration (e.g., drivers, services).
SOFTWARE: Stores software settings.
SAM: Security Accounts Manager data (e.g., local user accounts, passwords).
SECURITY: Security policies and permissions.
DEFAULT: Default user profile settings.
USERDIFF and user-specific hives (e.g., NTUSER.DAT in C:\Users<username>) for individual profiles, though these are linked to Config indirectly.
Technical Details:
Path: C:\Windows\System32\Config is the primary location for system-wide hives. Files lack extensions (e.g., “SYSTEM” not “SYSTEM.DAT”) and are backed by transaction logs (e.g., SYSTEM.LOG) for recovery.
Access: Direct file access is restricted while Windows runs, as the kernel locks them. Tools like reg save or offline forensic utilities (e.g., RegRipper) can extract them.
Backup: Copies may exist in C:\Windows\System32\config\RegBack (pre-Windows 10 1803) or repair folders (e.g., C:\Windows\Repair).
Security Implications: The registry is a prime target for attackers (e.g., persistence via Run keys) and malware (e.g., WannaCry modified registry entries). CNSP likely emphasizes securing this directory (e.g., NTFS permissions) and auditing changes (e.g., via Event Viewer, Event ID 4657). Compromising these files offline (e.g., via physical access) can extract password hashes from SAM.
Why other options are incorrect:
A . C:\Windows\debug: Used for debug logs (e.g., memory.dmp) or tools like DebugView, not registry hives. It’s unrelated to core configuration storage.
C . C:\Windows\security: Contains security-related files (e.g., audit logs, policy templates), but not the registry hives themselves.
D . All of the above: Only B is correct; including A and C dilutes accuracy.
Real-World Context: Forensic analysts target C:\Windows\System32\Config during investigations (e.g., parsing SAM with Mimikatz offline).

TCP uses a structured handshake, and its response to a connection attempt on a closed port follows a specific protocol when unobstructed by a firewall.
Why C is correct: A closed TCP port responds with a RST (Reset) and ACK (Acknowledgment) packet to terminate the connection attempt immediately. CNSP highlights this as a key scanning indicator.
Why other options are incorrect:
A: ICMP Port Unreachable is for UDP, not TCP.
B: FIN/ACK is for closing active connections, not rejecting new ones.
D: SYN/ACK indicates an open port during the TCP handshake.

Port 111/TCP is the default port for the RPC (Remote Procedure Call) portmapper service on Unix systems, which registers and manages RPC services.
Why A is correct: Running rpcinfo -p <hostname> queries the portmapper to list all registered RPC services, their programs, versions, and associated ports. This is a logical next step during a security audit or penetration test to identify potential vulnerabilities (e.g., NFS or NIS services). CNSP recommends this command for RPC enumeration.
Why other options are incorrect:
B . Telnet to the port to look for a banner: Telnet might connect, but RPC services don’t typically provide a human-readable banner, making this less effective than rpcinfo.
C . Telnet to the port, send “GET / HTTP/1.0” and gather information from the response: Port 111 is not an HTTP service, so an HTTP request is irrelevant and will likely fail.
D . None of the above: Incorrect, as A is a valid and recommended step.

A DNS zone transfer involves replicating the DNS zone data (e.g., all records for a domain) from a primary to a secondary DNS server, requiring a reliable transport mechanism.
Why A is correct: DNS zone transfers use TCP port 53 because TCP ensures reliable, ordered delivery of data, which is critical for transferring large zone files. CNSP notes that TCP is the standard protocol for zone transfers (e.g., AXFR requests), as specified in RFC 5936.
Why other options are incorrect:
B . 53/UDP: UDP port 53 is used for standard DNS queries and responses due to its speed and lower overhead, but it is not suitable for zone transfers, which require reliability over speed.
C . Both 1 and 2: This is incorrect because zone transfers are exclusively TCP-based, not UDP-based.
D . None of the above: Incorrect, as 53/TCP is the correct port for DNS zone transfers.

The screenshot shows an email labeled “B” with the subject “Verify your email address” purportedly from Apple. To determine if this is a phishing email, we need to analyze its content and characteristics against common phishing indicators as outlined in CNSP documentation. Since option A is not provided in the screenshot, we will evaluate email B and infer the context for A.
Analysis of Email B:
Sender and Branding: The email claims to be from “Apple Support” and includes an Apple logo, which is a common tactic to establish trust. However, phishing emails often impersonate legitimate brands like Apple to deceive users.
Subject and Content: The subject “Verify your email address” and the body requesting the user to verify their email by clicking a link (“Verify Your Email”) are typical of phishing attempts. Legitimate companies like Apple may send verification emails, but the tone and context here raise suspicion.
Link Presence: The email contains a clickable link (“Verify Your Email”) that is purportedly for email verification. The screenshot does not show the URL, but phishing emails often include malicious links that lead to fake login pages to steal credentials. CNSP emphasizes that unsolicited requests to click links for verification are a red flag.
Urgency and Vague Instructions: The email includes a statement, “If you did not make this change or believe an unauthorized person has accessed your account, click here to cancel and secure your account.” This creates a sense of urgency, a common phishing tactic to prompt immediate action without critical thinking.
Generic Greeting: The email starts with “Dear User,” a generic greeting often used in phishing emails. Legitimate companies like Apple typically personalize emails with the user’s name.
Suspicious Elements: The email mentions “your Apple ID ([email protected]),” which is a placeholder rather than a specific email address, further indicating a mass phishing campaign rather than a targeted, legitimate communication.
Phishing Indicators (per CNSP):
CNSP documentation on phishing identification lists several red flags:
Unsolicited requests for verification or account updates.
Generic greetings (e.g., “Dear User” instead of a personalized name).
Presence of links that may lead to malicious sites (not verifiable in the screenshot but implied).
Urgency or threats (e.g., “click here to cancel and secure your account”).
Impersonation of trusted brands (e.g., Apple).
Email B exhibits multiple indicators: the generic greeting, unsolicited verification request, urgent call to action, and impersonation of Apple.
Option A Context:
Since the screenshot only shows email B, and the correct answer is “Only B,” we can infer that email A (not shown) does not exhibit phishing characteristics. For example, A might be a legitimate email from Apple with proper personalization, no suspicious links, or a different context (e.g., a purchase confirmation rather than a verification request).
Evaluation of Options:
1. Only A: Incorrect, as email A is not shown, and the correct answer indicates B as the phishing email.
2. Only B: Correct. Email B shows clear phishing characteristics, such as impersonation, a generic greeting, an unsolicited verification link, and urgency, aligning with CNSP’s phishing criteria.
3. Both A and B: Incorrect, as A is implied to be non-phishing based on the correct answer.
4. None of the above: Incorrect, as B is a phishing email.
Conclusion: Email B is a phishing email due to its impersonation of Apple, generic greeting, unsolicited verification request with a link, and use of urgency to prompt action. Since A is not shown but implied to be non-phishing, the correct answer is “Only B.”

The Active Directory (AD) database on Windows domain controllers contains critical directory information, stored in a specific file format.
Why D is correct: The NTDS.DIT file (NT Directory Services Directory Information Tree) is the Active Directory database file, located in C:\Windows\NTDS\ on domain controllers. It stores all AD objects (users, groups, computers) and schema data in a hierarchical structure. CNSP identifies NTDS.DIT as the key file for AD data extraction in security audits.
Why other options are incorrect:
A . NTDS.DAT: Not a valid AD database file; may be a confusion with other system files.
B . NTDS.MDB: Refers to an older Microsoft Access database format, not used for AD.
C . MSAD.MDB: Not a recognized file for AD; likely a misnomer.

The net command in Windows is a legacy tool for managing users, groups, and network resources. The subcommand net localgroup <groupname> displays information about a specified local group on the machine where it’s run. Specifically:
net localgroup administrators lists all members (users and groups) of the local Administrators group on the current computer.
The local Administrators group grants elevated privileges (e.g., installing software, modifying system files) on that machine only, not domain-wide.
Output Example:
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer Members
——————————————————————————- Administrator Domain Admins The command completed successfully.
Technical Details:
Local groups are stored in the Security Accounts Manager (SAM) database (e.g., C:\Windows\System32\config\SAM).
This differs from domain groups (e.g., Domain Admins), managed via Active Directory.
Security Implications: Enumerating local admins is a reconnaissance step in penetration testing (e.g., to escalate privileges). CNSP likely covers this command for auditing and securing Windows systems.
Why other options are incorrect:
A . List domain admin users for the current domain: This requires net group “Domain Admins” /domain, which queries the domain controller, not the local SAM. net localgroup is strictly local.
Real-World Context: Attackers use this command post-compromise (e.g., via PsExec) to identify privilege escalation targets.

The EICAR test file is a standardized tool in security testing, designed for a specific purpose.
Why A is correct: The EICAR file (a 68-byte string) triggers antivirus detection without harm, testing response capabilities. CNSP recommends it for AV validation.
Why B is incorrect: It has no role in testing encryption; it’s solely for AV functionality.

UDP (User Datagram Protocol), per RFC 768, is connectionless, lacking TCP’s handshake or acknowledgment mechanisms. When a UDP packet reaches a port:
Closed Port: The host typically sends an ICMP “Destination Port Unreachable” (Type 3, Code 3) unless suppressed (e.g., by firewall or OS settings).
Open Port: If a service is listening (e.g., DNS on 53/UDP), it processes the packet but doesn’t inherently reply unless the application protocol requires it (e.g., DNS sends a response).
Scenario: An open UDP port behind a firewall, with the firewall rule allowing traffic (e.g., permit udp any host 10.0.0.1 eq 123). The packet reaches the service, but UDP itself doesn’t mandate a response. Most services (e.g., NTP, SNMP) only reply if the packet matches an expected request. In this question’s generic context (no specific service), no response is the default, as the firewall permits the packet, and the open port silently accepts it without feedback.
Security Implications: This silence makes UDP ports harder to scan (e.g., Nmap assumes “open|filtered” for no response), but exposed open ports risk amplification attacks (e.g., DNS reflection). CNSP likely contrasts UDP’s behavior with TCP for firewall rule crafting.
Why other options are incorrect:
A . ICMP message showing Port Unreachable: Occurs for closed ports, not open ones, unless the service explicitly rejects the packet (rare).
C . A SYN Packet: SYN is TCP-specific (handshake initiation), irrelevant to UDP.
D . A FIN Packet: FIN is TCP-specific (connection closure), not UDP.
Real-World Context: Testing UDP 53 (DNS) with dig @8.8.8.8 +udp yields a response, but generic UDP probes (e.g., nc -u) often get silence.

Online attacks require real-time interaction with a target system (e.g., a login interface), whereas offline attacks occur without direct system interaction, typically after obtaining data like password hashes. A rainbow table attack is an offline method that uses precomputed tables of hash values to reverse-engineer passwords from stolen hash databases, distinguishing it from the other options, which are online.
Why B is correct: Rainbow table attacks are performed offline after an attacker has already acquired a hash (e.g., from a compromised database). The attacker matches the hash against precomputed tables to find the plaintext password, requiring no interaction with the target system during the attack. CNSP classifies this as an offline password recovery technique.
Why other options are incorrect:
A: Brute force attacks involve repeatedly submitting password guesses to a live system (e.g., via SSH or a web login), making it an online attack.
C: Password spraying attacks test a few common passwords across many accounts on a live system, also an online attack aimed at avoiding lockouts.
D: Phishing attacks trick users into submitting credentials through fake interfaces (e.g., emails or websites), requiring real-time interaction and thus classified as online.

SSH (Secure Shell), per RFC 4251, uses asymmetric cryptography (e.g., RSA, ECDSA) for secure authentication:
Key Pair:
Public Key: Freely shareable, used to encrypt or verify.
Private Key: Secret, used to decrypt or sign.
Process:
User generates a key pair (e.g., ssh-keygen -t rsa -b 4096).
Public Key is uploaded to the server, appended to ~/.ssh/authorized_keys (e.g., via ssh-copy-id).
Private Key (e.g., ~/.ssh/id_rsa) stays on the user’s machine.
Authentication: Client signs a challenge with the private key; server verifies it with the public key.
Technical Details:
Protocol: SSH-2 (RFC 4253) uses a Diffie-Hellman key exchange, then public-key auth.
Files: authorized_keys (server, 0644 perms), private key (client, 0600 perms).
Security: Private key exposure compromises all systems trusting the public key.
Security Implications: CNSP likely stresses key management (e.g., passphrases, rotation) and server-side authorized_keys hardening (e.g., PermitRootLogin no).
Why other options are incorrect:
B: Uploading the private key reverses the model, breaking security-anyone with the server’s copy could authenticate as the user. Asymmetric crypto relies on the private key remaining secret.
Real-World Context: GitHub uses SSH public keys for repository access, with private keys on user devices.

In Linux, password hashes are stored in a secure file to protect user authentication data. The evolution of Linux security practices moved password storage from plaintext or weakly protected files to a more secure location.
Why C is correct: The /etc/shadow file is the standard location for storing password hashes in modern Linux systems. This file is readable only by the root user, enhancing security by restricting access. It contains encrypted password hashes (typically using algorithms like SHA-512), along with user details such as password expiration policies. CNSP documentation on Linux security emphasizes /etc/shadow as the authoritative source for password hashes, replacing older methods.
Why other options are incorrect:
A . /etc/passwd: Historically, /etc/passwd stored passwords in plaintext or weakly hashed forms (e.g., using DES), but modern systems use it only for user account information (e.g., UID, GID, home directory) and reference /etc/shadow for hashes.
B . /etc/password: This is not a valid file in the Linux file system; it appears to be a typographical error or misunderstanding, with no recognized role in password storage.
D . /usr/bin/shadow: /usr/bin contains executable binaries, not configuration or data files like password hashes. /etc/shadow is the correct path.

Negotiating a shared encryption key involves a process where two parties agree on a secret key over an insecure channel without directly transmitting it. This is distinct from encryption or hashing algorithms, which serve different purposes.
Why C is correct: The Diffie-Hellman (DH) algorithm is a key exchange protocol that enables two parties to establish a shared secret key using mathematical operations (e.g., modular exponentiation). It’s widely used in protocols like TLS and IPsec, as noted in CNSP for secure key negotiation.
Why other options are incorrect:
A: Triple-DES is a symmetric encryption algorithm for data encryption, not key negotiation.
B: SHA1 is a hash function for integrity, not key exchange.
D: AES is a symmetric encryption algorithm, not a key exchange mechanism.

Microsoft SQL Server (MSSQL) relies on specific ports for its core services, as defined by Microsoft and registered with IANA:
1433/TCP: The default port for the SQL Server Database Engine. Clients connect here for querying databases (e.g., via ODBC or JDBC). It’s a well-known port, making it a frequent target for attacks if exposed.
1434/UDP: Used by the SQL Server Browser Service, which listens for incoming requests and redirects clients to the correct port/instance (especially for named instances). It’s critical for discovering dynamic ports when 1433 isn’t used.
1434/TCP: Less commonly highlighted but used in some configurations, such as dedicated admin connections (DAC) or when the Browser Service responds over TCP for specific instances. While 1433/TCP is the primary engine port, 1434/TCP can be involved in multi-instance setups.
Technical Details:
Ports can be customized (e.g., via SQL Server Configuration Manager), but these are defaults.
Named instances often use dynamic ports (allocated from the ephemeral range), with the Browser Service (1434/UDP) guiding clients to them.
Firewalls must allow these ports for MSSQL to function externally, posing risks if not secured (e.g., brute-force attacks on 1433/TCP).
Security Implications: CNSP likely covers MSSQL port security, as vulnerabilities like SQL Slammer (2003) exploited 1434/UDP misconfigurations. Hardening includes restricting access, changing defaults, and monitoring traffic.
Why other options are incorrect:
A . 1433/TCP, 2433/UDP, 3433/TCP: 2433/UDP and 3433/TCP are not MSSQL standards; they’re likely typos or unrelated ports.
C . 1433/TCP, 2433/UDP, 1434/TCP: 2433/UDP is incorrect; 1434/UDP is the Browser Service port.
D . 1533/TCP, 1434/UDP, 2434/TCP: 1533/TCP and 2434/TCP aren’t associated with MSSQL; they deviate from documented defaults.
Real-World Context: Tools like netstat -an | find “1433” on Windows confirm MSSQL’s port usage during audits.

TCP (Transmission Control Protocol) ensures reliable, ordered data delivery via a connection-oriented handshake, contrasting with UDP’s lightweight, connectionless approach. Analyzing each service:
C . HTTP (Hypertext Transfer Protocol): Uses TCP (port 80) for web traffic. TCP’s reliability ensures HTML, images, etc., arrive intact. HTTPS (TCP 443) extends this with TLS. RFC 2616 mandates TCP.
A . SNMP (Simple Network Management Protocol): Defaults to UDP (port 161) for monitoring devices. UDP’s speed suits its lightweight queries, though TCP variants exist (rarely used).
B . NTP (Network Time Protocol): Uses UDP (port 123) per RFC 5905. UDP minimizes latency for time sync, tolerating occasional packet loss.
D . IKE (Internet Key Exchange): Part of IPsec, uses UDP (port 500) per RFC 7296. UDP suits its negotiation phase; TCP isn’t standard.
Security Implications: TCP services like HTTP are more prone to state-based attacks (e.g., SYN floods) than UDP counterparts. CNSP likely contrasts TCP vs. UDP in protocol analysis.
Why other options are incorrect:
A, B, D: All default to UDP for efficiency, not TCP’s reliability.
Real-World Context: Firewalls prioritize TCP 80/443 rules for HTTP/HTTPS, while UDP 123 is opened for NTP servers.

DDoS (Distributed Denial of Service) attacks aim to overwhelm a target’s resources with excessive traffic, disrupting availability, whereas other attack types target different goals.
Why D is correct: Brute force attacks focus on guessing credentials (e.g., passwords) to gain unauthorized access, not on denying service. CNSP classifies it as an authentication attack, not a DDoS method.
Why other options are incorrect:
A: SYN Flood exhausts TCP connection resources, a classic DDoS attack.
B: NTP Amplification leverages amplified responses to flood targets, a DDoS technique.
C: UDP Flood overwhelms a system with UDP packets, another DDoS method.