SANS FOUNDATION SEC275 EXAMINATION
TEST 2026 QUESTIONS WITH SOLUTIONS
GRADED A+
◉ /i. Answer: Don't try to run as administrator, run as a normal user
instead (this won't matter because of AlwaysInstallElevated).
◉ /quiet. Answer: Don't show the user any messages.
◉ 1024?!. Answer: 1 kilobyte = 1024 bytes. IEC introduced KiB
instead: 1 byte is 8 bits. 1 kibibyte (KiB) is 1024 bytes. 1 mebibyte
(MiB) is 1024 kibibytes. 1 gibibyte (GiB) is 1024 mebibytes. 1 tebibyte
(TiB) is 1024 gibibytes.
◉ Active Directory. Answer: A system that allows the server to
communicate with Windows desktops, allowing the administrator to
easily configure all the connected desktops from one location, amongst
other uses which we will cover in future modules. Active Directory
allows administrators to configure settings on Windows desktops that are
connected to a Windows server.
◉ Adding a new user. Answer: Adding a new user is as simple as
running: net user /add <username> <password> This command will
,create a new user and set the password to what you specified. You can
do so much more when creating users this way, such as configuring
account expiry and setting times where the account can log on.
◉ Add-ins. Answer: Microsoft Word allows for third parties to write
'add-ins', which extend the functionality of Microsoft Word.
◉ Advanced Memory Forensics with Volatility. Answer: Volatility is one
of the most widely used memory forensics tools. Useful Volatility
commands: imageinfo - vol.py or volatility -f memdump.mem imageinfo
◉ Aliases. Answer: PowerShell comes with several aliases set up for
common cmdlets. cat, cd, dir, ls, rm
◉ Alternate Number Bases. Answer: We are very used to counting in
base 10, but other number bases like base 16 (hex) or base 2 (binary) are
incredibly useful in computing.
◉ Alternative Search Engines. Answer: No two search engines are the
same. Alternative Search Engines - Google, Bing, Yahoo, DuckDuckGo,
archive.org
◉ AlwaysInstall Elevated. Answer: Some administrators will configure
this so that users can install software on their computers without
administrator approval.
,◉ Analytics. Answer: Collecting stats and analysing interactions on a
web server.
◉ Anti Forensics. Answer: Cyber criminals improve and modify their
operational security (OpSec) in order to avoid being caught. NotPetya is
part of the Petya family of encrypting ransomware that targets Microsoft
Windows based systems.
◉ APFS. Answer: The Apple File System supports permissions and
encryption, and duplicate files can be stored without using additional
space, with changes to one copy of a file being saved as a delta (the
difference between the old file and the new file) to lower space
requirements.
◉ Application Layer. Answer: An example of an application layer
protocol is something like HTTP or FTP. HTTP GET request is an
application layer protocol because the web browser will form the request
necessary for displaying a page or submitting a form.
◉ apropos. Answer: The 'apropos' tool is used to search man pages for
keywords, usually to find the 'appropriate' tool to use in a particular
situation. The 'apropos' command is used to find the 'appropriate' tool for
a particular job.
, ◉ apt-get. Answer: The apt command is incredibly useful to rapidly
find, install, or remove software. The way 'apt' works is by having a list
of 'sources'; these are servers which contain information about available
packages, download links and version information. 'apt update' only
updates the list of available packages.
◉ Arguments. Answer: The 'argc' variable is an integer which contains
the number of arguments passed to the program when it was executed.
The 'argv' array contains the data passed in.
◉ Arithmetic Logic Unit (ALU). Answer: The Arithmetic Logic Unit is
the part of the CPU responsible for performing arithmetic and logical
operations.
◉ ARP. Answer: The Address Resolution Protocol translates IP
addresses to MAC addresses for transmission purposes. ARP is only for
the local network.
◉ ARP Cache. Answer: ARP (address resolution protocol) is a protocol
used on local networks to map IP addresses to MAC addresses. When a
computer receives an ARP response, it saves it into the ARP cache.
◉ ARP Spoofing / Poisoning. Answer: The flaw in the ARP protocol
comes because, if an ARP response is sent to a computer, it will store
that value in its ARP cache even if it didn't make an ARP request asking
for a response.
TEST 2026 QUESTIONS WITH SOLUTIONS
GRADED A+
◉ /i. Answer: Don't try to run as administrator, run as a normal user
instead (this won't matter because of AlwaysInstallElevated).
◉ /quiet. Answer: Don't show the user any messages.
◉ 1024?!. Answer: 1 kilobyte = 1024 bytes. IEC introduced KiB
instead: 1 byte is 8 bits. 1 kibibyte (KiB) is 1024 bytes. 1 mebibyte
(MiB) is 1024 kibibytes. 1 gibibyte (GiB) is 1024 mebibytes. 1 tebibyte
(TiB) is 1024 gibibytes.
◉ Active Directory. Answer: A system that allows the server to
communicate with Windows desktops, allowing the administrator to
easily configure all the connected desktops from one location, amongst
other uses which we will cover in future modules. Active Directory
allows administrators to configure settings on Windows desktops that are
connected to a Windows server.
◉ Adding a new user. Answer: Adding a new user is as simple as
running: net user /add <username> <password> This command will
,create a new user and set the password to what you specified. You can
do so much more when creating users this way, such as configuring
account expiry and setting times where the account can log on.
◉ Add-ins. Answer: Microsoft Word allows for third parties to write
'add-ins', which extend the functionality of Microsoft Word.
◉ Advanced Memory Forensics with Volatility. Answer: Volatility is one
of the most widely used memory forensics tools. Useful Volatility
commands: imageinfo - vol.py or volatility -f memdump.mem imageinfo
◉ Aliases. Answer: PowerShell comes with several aliases set up for
common cmdlets. cat, cd, dir, ls, rm
◉ Alternate Number Bases. Answer: We are very used to counting in
base 10, but other number bases like base 16 (hex) or base 2 (binary) are
incredibly useful in computing.
◉ Alternative Search Engines. Answer: No two search engines are the
same. Alternative Search Engines - Google, Bing, Yahoo, DuckDuckGo,
archive.org
◉ AlwaysInstall Elevated. Answer: Some administrators will configure
this so that users can install software on their computers without
administrator approval.
,◉ Analytics. Answer: Collecting stats and analysing interactions on a
web server.
◉ Anti Forensics. Answer: Cyber criminals improve and modify their
operational security (OpSec) in order to avoid being caught. NotPetya is
part of the Petya family of encrypting ransomware that targets Microsoft
Windows based systems.
◉ APFS. Answer: The Apple File System supports permissions and
encryption, and duplicate files can be stored without using additional
space, with changes to one copy of a file being saved as a delta (the
difference between the old file and the new file) to lower space
requirements.
◉ Application Layer. Answer: An example of an application layer
protocol is something like HTTP or FTP. HTTP GET request is an
application layer protocol because the web browser will form the request
necessary for displaying a page or submitting a form.
◉ apropos. Answer: The 'apropos' tool is used to search man pages for
keywords, usually to find the 'appropriate' tool to use in a particular
situation. The 'apropos' command is used to find the 'appropriate' tool for
a particular job.
, ◉ apt-get. Answer: The apt command is incredibly useful to rapidly
find, install, or remove software. The way 'apt' works is by having a list
of 'sources'; these are servers which contain information about available
packages, download links and version information. 'apt update' only
updates the list of available packages.
◉ Arguments. Answer: The 'argc' variable is an integer which contains
the number of arguments passed to the program when it was executed.
The 'argv' array contains the data passed in.
◉ Arithmetic Logic Unit (ALU). Answer: The Arithmetic Logic Unit is
the part of the CPU responsible for performing arithmetic and logical
operations.
◉ ARP. Answer: The Address Resolution Protocol translates IP
addresses to MAC addresses for transmission purposes. ARP is only for
the local network.
◉ ARP Cache. Answer: ARP (address resolution protocol) is a protocol
used on local networks to map IP addresses to MAC addresses. When a
computer receives an ARP response, it saves it into the ARP cache.
◉ ARP Spoofing / Poisoning. Answer: The flaw in the ARP protocol
comes because, if an ARP response is sent to a computer, it will store
that value in its ARP cache even if it didn't make an ARP request asking
for a response.
