Get The SecOps Group CNSP Exam Practice Questions - Real and Updated

Answer : C

A null session in Windows is an unauthenticated connection to certain administrative shares, historically used for system enumeration. The net use command connects to a share, and the IPC$ (Inter-Process Communication) share is the standard target for null sessions, allowing access without credentials when configured to permit it.

Why C is correct: The command net use \\hostname\ipc$ '' /u:'' specifies the IPC$ share and uses empty strings for the password (first '') and username (/u:''), establishing a null session. This syntax is correct for older Windows systems (e.g., XP or 2003) where null sessions were more permissive, a topic covered in CNSP for legacy system vulnerabilities.

Why other options are incorrect:

A: Targets the c$ share (not typically used for null sessions) and uses /u:NULL, which is invalid syntax; the username must be an empty string ('').

B: Targets c$ instead of ipc$, making it incorrect for null session establishment.

D: Uses ipc$ correctly but specifies /u:NULL, which is not the proper way to denote an empty username.

Answer : B

The Windows Registry is a hierarchical database storing configuration settings for the operating system, applications, and hardware. It's physically stored as hive files on disk, located in the directory C:\Windows\System32\Config. These files are loaded into memory at boot time and managed by the Windows kernel. Key hive files include:

SYSTEM: Contains hardware and system configuration (e.g., drivers, services).

SOFTWARE: Stores software settings.

SAM: Security Accounts Manager data (e.g., local user accounts, passwords).

SECURITY: Security policies and permissions.

DEFAULT: Default user profile settings.

USERDIFF and user-specific hives (e.g., NTUSER.DAT in C:\Users<username>) for individual profiles, though these are linked to Config indirectly.

Technical Details:

Path: C:\Windows\System32\Config is the primary location for system-wide hives. Files lack extensions (e.g., 'SYSTEM' not 'SYSTEM.DAT') and are backed by transaction logs (e.g., SYSTEM.LOG) for recovery.

Access: Direct file access is restricted while Windows runs, as the kernel locks them. Tools like reg save or offline forensic utilities (e.g., RegRipper) can extract them.

Backup: Copies may exist in C:\Windows\System32\config\RegBack (pre-Windows 10 1803) or repair folders (e.g., C:\Windows\Repair).

Security Implications: The registry is a prime target for attackers (e.g., persistence via Run keys) and malware (e.g., WannaCry modified registry entries). CNSP likely emphasizes securing this directory (e.g., NTFS permissions) and auditing changes (e.g., via Event Viewer, Event ID 4657). Compromising these files offline (e.g., via physical access) can extract password hashes from SAM.

Why other options are incorrect:

A . C:\Windows\debug: Used for debug logs (e.g., memory.dmp) or tools like DebugView, not registry hives. It's unrelated to core configuration storage.

C . C:\Windows\security: Contains security-related files (e.g., audit logs, policy templates), but not the registry hives themselves.

D . All of the above: Only B is correct; including A and C dilutes accuracy.

Real-World Context: Forensic analysts target C:\Windows\System32\Config during investigations (e.g., parsing SAM with Mimikatz offline).

Answer : A

Encryption ensures confidentiality and integrity of network traffic. Analyzing defaults:

A . DNS (Domain Name System):

Default: Unencrypted (UDP/TCP 53), per RFC 1035. Queries/responses (e.g., ''google.com 142.250.190.14'') are plaintext.

Modern Options: DNS over HTTPS (DoH, TCP 443) or DNS over TLS (DoT, TCP 853) encrypt, but aren't default in most systems (e.g., pre-2020 Windows).

B . SSH (Secure Shell):

Default: Encrypted (TCP 22), per RFC 4251. Uses asymmetric (e.g., RSA) and symmetric (e.g., AES) crypto for all sessions.

C . FTPS (FTP Secure):

Default: Encrypted (TCP 21 control, dynamic data ports). Extends FTP with SSL/TLS (e.g., RFC 4217), securing file transfers.

Technical Details:

DNS: Plaintext exposes queries to eavesdropping (e.g., ISP snooping) or spoofing (e.g., cache poisoning).

SSH/FTPS: Encryption is baked into their standards; disabling it requires explicit misconfiguration.

Security Implications: Unencrypted DNS risks privacy and integrity (e.g., Kaminsky attack). CNSP likely pushes DoH/DoT adoption.

Why other options are incorrect:

B, C: Encrypt by default.

D: False, as only DNS lacks default encryption.

Real-World Context: The 2013 Snowden leaks exposed DNS monitoring; DoH uptake (e.g., Cloudflare 1.1.1.1) counters this.

Answer : A

TLS (Transport Layer Security) secures communication (e.g., HTTPS) using certificates, per RFC 8446. A certificate includes:

Validity Period: Start and end dates (e.g., 'Not After: March 8, 2025').

Purpose: Authenticates the server and encrypts the session.

Scenario: An expired TLS certificate (e.g., past 'Not After' date). Modern browsers (e.g., Chrome, Firefox) validate certificates during the handshake:

ClientHello: Browser initiates TLS.

ServerHello: Server sends its certificate.

Validation: Browser checks expiration, CA trust, etc.

If expired, browsers reject the handshake, displaying errors (e.g., 'NET::ERR_CERT_DATE_INVALID'). No session key is negotiated, and communication doesn't proceed over TLS. Users may bypass warnings (e.g., 'Advanced > Proceed'), but this is unencrypted or uses a fallback (not standard TLS), breaking security guarantees.

Security Implications: Expired certificates expose sites to MITM attacks, as trust is lost. CNSP likely emphasizes certificate management (e.g., automation with Let's Encrypt) to avoid this.

Why other options are incorrect:

B . The communication is still over TLS: False; an expired certificate halts the TLS handshake in compliant browsers. Legacy systems might negotiate insecurely, but this isn't 'TLS' per standards.

Real-World Context: The 2019 Equifax breach partially stemmed from expired certificates missing vulnerabilities.

Answer : A

Port 111/TCP is the default port for the RPC (Remote Procedure Call) portmapper service on Unix systems, which registers and manages RPC services.

Why A is correct: Running rpcinfo -p <hostname> queries the portmapper to list all registered RPC services, their programs, versions, and associated ports. This is a logical next step during a security audit or penetration test to identify potential vulnerabilities (e.g., NFS or NIS services). CNSP recommends this command for RPC enumeration.

Why other options are incorrect:

B . Telnet to the port to look for a banner: Telnet might connect, but RPC services don't typically provide a human-readable banner, making this less effective than rpcinfo.

C . Telnet to the port, send 'GET / HTTP/1.0' and gather information from the response: Port 111 is not an HTTP service, so an HTTP request is irrelevant and will likely fail.

D . None of the above: Incorrect, as A is a valid and recommended step.