SANS FOR508 FINAL TEST 2026
QUESTIONS WITH CORRECT
ANSWERS GRADED A+
◍ Everyone can do everything they need to do and nothing more. Bradley
Manning - WikiLeaks Target - HVAC hack.
Answer: Principle of Least Privilege
◍ shimcache.
Answer: Aka application compatibility cacheShows all executables launched
since last reboot
◍ The cornerstone of all security: Everyting done in security addresses one or
more of these three thingsConfidentiality, Integrity,
availabilityConfidentiality - Only those who need to access something can;
ties into principle of least privilegeIntegrity - data is edited correctly and by
the right people. Failure ex.: Delta $5 tickets round trip tickets to anywhere
Delta flies/attach on pricing databaseAvailability - If you cannot use it, why
do you have it?.
Answer: CIA Triad
◍ Pharmaceuticals and government, research.
Answer: Confidentiality
◍ Financials maintained in part by confidentiality.
Answer: Integrity
◍ amcache.
Answer: registry file that stores history of executed applications
◍ prefetch.
Answer: designed to speed up the application startup process and shows
, evidence of exe use.https://www.forensicswiki.org/wiki/Prefetch
◍ jumplists.
Answer: a feature introduced in Windows 7. This feature allows you to view
recent documents in a program that is pinned to your taskbar.
◍ shellbags.
Answer: Registry keys to maintain the size, view, icon, and position of a
folder when using Explorer. These persist information for directories even
after the directory is removed, which means that they can be used to
enumerate past mounted volumes, deleted files, and user actions.
◍ eCommerce Ex. Amazon make $133,000/per minute thus denial of service
is critical business impact; power company need to keep lights on =
availability issue.
Answer: Availability
◍ Browser Helper Objects.
Answer: a DLL module designed as a plugin for Microsoft's Internet
Explorer web browser to provide added functionality.
◍ Authentication, Authorization, Accountability.
Answer: AAA
◍ MRU keys.
Answer: Most Recently Used keys lists for the following types of
information: Find Files, Find Computer, printer ports, and streaming data.
◍ AppCompatCache.
Answer: Windows Application Compatibility Cache - the data in the cache
is only serialized to the registry when the system is shutdown or restarted.
◍ webcachev01.dat.
Answer: IE10 file which records web history (similar to index.dat in older
versions)
◍ Detailed steps to make policy happen.
Answer: Procedure
,◍ UserAssist.
Answer: A set of registry keys which keep track of programs that executed.
... contains only statistical data on the applications launched by the user via
Windows Explorer.
◍ Policy, Procedure and Training.
Answer: PPT
◍ Users must know what policies and procedures say to follow them..
Answer: Training
◍ Broad general statement of management's intent to protect information.
Answer: Policy
◍ Kansa.
Answer: Powershell based remote IR tool. Collects artifacts and provides
analysis/parsing scripts.
◍ A security professional needs to be:1/3 technologist1/3 manager1/3
lawyer-Tkhis is the perfect summation of the career field.-Technology
supports security efforts-Management decisions (and budgets) drive
security-Legal issues mandate security requirements.
Answer: Security by Thirds
◍M
Z. ...
Answer: Hex header for portable executable (PE) file (e.g. .exe or .dll)
◍ SSDT.
Answer: Volatility Plugin - for...
◍ log2timeline.py.
Answer: Creates a supertimeline by processing plaso output.
◍ Senior Mgmt:-Has legal responsibility to protect the assets of the org:That
give him the ultimate responsibility for security-Authority can be delegated
- responsibility cannot beData owner - person or office with primary
responsibility for data; owners determine classification, protective measures
, and moreData custodian - the person/group that implement the controls;
make the decisions of the owner happensUsers - use data; are also
automatically data custodians.
Answer: Security Roles and Responsiblities
◍ body file.
Answer: A database of timeline information which swveral tools outpit
tonfor supertimeline Creation
◍ pffexport.
Answer: Extracts the personal folder file from Outlook
◍ safety of people.
Answer: Number 1 Goal of Security
◍ years ago: teenagerstoday: we face organized crime and nation states-well
funded-highly motivateddisgruntled insider: difficult to counter; tends to be
subtle; often damaging or even devastatingAccidental insider: common; also
tend to be subtle; in aggregate - even ore damagingOutsider threat source -
inside threat actor: a growing proble, the current most-common attack
vector2014 - 47% of
U. S. adults had private data compromised in a breach (NBC News)FBI can
prove it was North Korea that attacked Sony.
Answer: Nature of the Threat
◍ Superfetch.
Answer: a feature that attempts to determine which applications you will
launch and then loads up all the necessary files and data into memory.
◍ Procdump.
Answer: Volatility plugin which dumps the exe from memory
◍ Memdump.
Answer: Volatility plugin - Dumps entire memory space for a process (e.g.
firefix.exe and url history)
◍ Conhost.exe.
QUESTIONS WITH CORRECT
ANSWERS GRADED A+
◍ Everyone can do everything they need to do and nothing more. Bradley
Manning - WikiLeaks Target - HVAC hack.
Answer: Principle of Least Privilege
◍ shimcache.
Answer: Aka application compatibility cacheShows all executables launched
since last reboot
◍ The cornerstone of all security: Everyting done in security addresses one or
more of these three thingsConfidentiality, Integrity,
availabilityConfidentiality - Only those who need to access something can;
ties into principle of least privilegeIntegrity - data is edited correctly and by
the right people. Failure ex.: Delta $5 tickets round trip tickets to anywhere
Delta flies/attach on pricing databaseAvailability - If you cannot use it, why
do you have it?.
Answer: CIA Triad
◍ Pharmaceuticals and government, research.
Answer: Confidentiality
◍ Financials maintained in part by confidentiality.
Answer: Integrity
◍ amcache.
Answer: registry file that stores history of executed applications
◍ prefetch.
Answer: designed to speed up the application startup process and shows
, evidence of exe use.https://www.forensicswiki.org/wiki/Prefetch
◍ jumplists.
Answer: a feature introduced in Windows 7. This feature allows you to view
recent documents in a program that is pinned to your taskbar.
◍ shellbags.
Answer: Registry keys to maintain the size, view, icon, and position of a
folder when using Explorer. These persist information for directories even
after the directory is removed, which means that they can be used to
enumerate past mounted volumes, deleted files, and user actions.
◍ eCommerce Ex. Amazon make $133,000/per minute thus denial of service
is critical business impact; power company need to keep lights on =
availability issue.
Answer: Availability
◍ Browser Helper Objects.
Answer: a DLL module designed as a plugin for Microsoft's Internet
Explorer web browser to provide added functionality.
◍ Authentication, Authorization, Accountability.
Answer: AAA
◍ MRU keys.
Answer: Most Recently Used keys lists for the following types of
information: Find Files, Find Computer, printer ports, and streaming data.
◍ AppCompatCache.
Answer: Windows Application Compatibility Cache - the data in the cache
is only serialized to the registry when the system is shutdown or restarted.
◍ webcachev01.dat.
Answer: IE10 file which records web history (similar to index.dat in older
versions)
◍ Detailed steps to make policy happen.
Answer: Procedure
,◍ UserAssist.
Answer: A set of registry keys which keep track of programs that executed.
... contains only statistical data on the applications launched by the user via
Windows Explorer.
◍ Policy, Procedure and Training.
Answer: PPT
◍ Users must know what policies and procedures say to follow them..
Answer: Training
◍ Broad general statement of management's intent to protect information.
Answer: Policy
◍ Kansa.
Answer: Powershell based remote IR tool. Collects artifacts and provides
analysis/parsing scripts.
◍ A security professional needs to be:1/3 technologist1/3 manager1/3
lawyer-Tkhis is the perfect summation of the career field.-Technology
supports security efforts-Management decisions (and budgets) drive
security-Legal issues mandate security requirements.
Answer: Security by Thirds
◍M
Z. ...
Answer: Hex header for portable executable (PE) file (e.g. .exe or .dll)
◍ SSDT.
Answer: Volatility Plugin - for...
◍ log2timeline.py.
Answer: Creates a supertimeline by processing plaso output.
◍ Senior Mgmt:-Has legal responsibility to protect the assets of the org:That
give him the ultimate responsibility for security-Authority can be delegated
- responsibility cannot beData owner - person or office with primary
responsibility for data; owners determine classification, protective measures
, and moreData custodian - the person/group that implement the controls;
make the decisions of the owner happensUsers - use data; are also
automatically data custodians.
Answer: Security Roles and Responsiblities
◍ body file.
Answer: A database of timeline information which swveral tools outpit
tonfor supertimeline Creation
◍ pffexport.
Answer: Extracts the personal folder file from Outlook
◍ safety of people.
Answer: Number 1 Goal of Security
◍ years ago: teenagerstoday: we face organized crime and nation states-well
funded-highly motivateddisgruntled insider: difficult to counter; tends to be
subtle; often damaging or even devastatingAccidental insider: common; also
tend to be subtle; in aggregate - even ore damagingOutsider threat source -
inside threat actor: a growing proble, the current most-common attack
vector2014 - 47% of
U. S. adults had private data compromised in a breach (NBC News)FBI can
prove it was North Korea that attacked Sony.
Answer: Nature of the Threat
◍ Superfetch.
Answer: a feature that attempts to determine which applications you will
launch and then loads up all the necessary files and data into memory.
◍ Procdump.
Answer: Volatility plugin which dumps the exe from memory
◍ Memdump.
Answer: Volatility plugin - Dumps entire memory space for a process (e.g.
firefix.exe and url history)
◍ Conhost.exe.
