IS 5403 CYBERSECURITY - OPERATING SYSTEMS
QUIZZES 1-10 WINDOWS, LINUX, MACOS, SECURITY,
CLOUD & VIRTUALIZATION TRINE UNIVERSITY 2026
150 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Analyze OS security mechanisms (access tokens, MAC, code signing, kernel mitigations) and predict
failure modes under attack
2 Evaluate cloud and virtualization isolation models (hypervisor, container namespaces, IAM) for
privilege-escalation and lateral-movement risk
3 Synthesize cryptographic and OS-level controls to design resilient defenses against credential theft and
memory-corruption exploits
4 IS 5403 Cybersecurity
5 Operating Systems Quizzes 1
6 10 Windows
7 Linux
8 macOS
9 Security
10 Cloud & Virtualization Trine University 2026
11 Foundations of Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud &
Virtualization
12 Applied Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud & Virtualization
13 Advanced Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud & Virtualization
14 Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud & Virtualization Review
ABSTRACT
Page 1
,This study document brings together 150 carefully worded exam questions drawn from IS 5403
Cybersecurity - Operating Systems Quizzes 1-10 Windows, Linux, macOS, Security, Cloud &
Virtualization Trine University 2026, with the strongest emphasis placed on Analyze OS security
mechanisms (access tokens, MAC, code signing, kernel mitigations) and predict failure modes
under attack, Evaluate cloud and virtualization isolation models (hypervisor, container
namespaces, IAM) for privilege-escalation and lateral-movement risk and Synthesize cryptographic
and OS-level controls to design resilient defenses against credential theft and memory-corruption
exploits. Every item follows the wording style and level of reasoning you meet in the real paper,
and each one is paired with a clear rationale so the correct choice is never a guess. Work through
the set at your own pace, mark the questions that slow you down, then come back to them until the
reasoning feels automatic. Learners who revise this way walk into the exam room recognising the
pattern behind the questions instead of meeting them for the first time. Keep going - steady, honest
practice is what turns a difficult paper into a comfortable pass.
Q1 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A Windows 11 host enforces Credential Guard. An attacker with local admin
dumps LSASS memory but recovers only a Kerberos TGT hash, not the cleartext
NTLM hash. Which architectural change best explains this outcome?
A. LSASS runs as a Protected Process Light (PPL) with VBS-isolated credential storage, so
secrets never reside in the LSASS address space. CORRECT
B. Credential Guard encrypts the SAM hive with DPAPI-NG, preventing LSASS from reading
local account hashes.
C. Windows Defender Application Guard blocks all memory reads by non-Microsoft signed
processes.
D. Kerberos AES keys are stored in the TPM and released only to the LSAISO process via a
sealed envelope.
RATIONALE: Credential Guard uses Virtualization-Based Security (VBS) to isolate LSA secrets
in a secure kernel, and LSASS becomes a PPL so even admin-level memory reads cannot
extract them. B confuses SAM protection with LSASS isolation; C is a browser/container control,
not a memory-read barrier; D misstates TPM key release semantics (TPM seals keys but does
not mediate LSASS reads).
Page 2
,Q2 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
On a hardened Linux server, SELinux is in enforcing mode; a web daemon
(httpd_t) attempts to write to /var/www/uploads (type httpd_sys_rw_content_t) but
is denied. The DAC permissions are 0777. Which is the most precise remediation?
A. Run `chmod 0770` to align DAC with MAC expectations.
B. Add a targeted policy module allowing httpd_t write to httpd_sys_rw_content_t, or set the file
context to a type the domain may write. CORRECT
C. Disable SELinux temporarily with `setenforce 0` to confirm the cause.
D. Add the daemon user to the `wheel` group so it inherits unconfined_t.
RATIONALE: SELinux denial is a type-enforcement (TE) issue independent of DAC; the fix is a
policy rule or correct file context. A changes DAC, which is already permissive and irrelevant to
the MAC denial. C is a diagnostic step, not a remediation, and weakens security. D misuses
group membership and would not change the domain transition.
Q3 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A macOS binary is signed with a Developer ID certificate but lacks the
`com.apple.security.cs.disable-library-validation` entitlement. At launch it attempts
to load a third-party dylib. What is the expected outcome under the hardened
runtime?
A. The dylib loads because Developer ID signatures bypass library validation.
B. The process is killed by Gatekeeper before library validation occurs.
C. Library validation fails and the dylib load is denied unless the dylib is signed by the same
Team ID or Apple. CORRECT
D. The dylib loads but is sandboxed into a separate App Sandbox container.
RATIONALE: The hardened runtime enforces library validation, requiring loaded libraries to be
signed by the same Team ID or Apple unless the disable-library-validation entitlement is present.
A is false-Developer ID does not bypass library validation. B confuses Gatekeeper (launch-time
notarization) with runtime library validation. D mischaracterizes App Sandbox, which is a
separate opt-in entitlement.
Page 3
, Q4 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A cloud IAM policy grants `sts:AssumeRole` on a role whose trust policy allows
`Principal: "*"` with condition `aws:PrincipalOrgID: o-abc123`. Which residual risk
remains despite the OrgID condition?
A. Any principal in the organization can assume the role, enabling lateral movement if a single
account is compromised. CORRECT
B. The condition is ignored for service principals, so any AWS service can assume the role.
C. OrgID conditions are evaluated only for the management account, not member accounts.
D. The role can be assumed by anonymous internet users because `Principal: "*"` overrides the
condition.
RATIONALE: The OrgID condition restricts assumption to accounts in the org, but any principal in
any member account can assume it, so a single compromised account enables lateral
movement. B is false-service principals are still subject to conditions. C is false-OrgID is
evaluated for all member accounts. D is false-conditions are conjunctive with the principal, not
overridden.
Q5 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A Linux container escapes via a kernel exploit that corrupts a `struct file` object.
Which mitigation, if enabled, would most likely have converted the corruption into
a controlled crash rather than a privilege escalation?
A. Seccomp-bpf filtering of the `io_uring` syscall.
B. Kernel Address Space Layout Randomization (KASLR) combined with SMEP/SMAP.
C. Control Flow Integrity (CFI) via Clang's `-fsanitize=cfi` for kernel modules.
D. Kernel heap hardening (SLAB_FREELIST_HARDENED,
CONFIG_SLAB_FREELIST_RANDOM) with `struct file` in a dedicated cache. CORRECT
RATIONALE: Heap hardening randomizes freelist metadata and separates caches, making
controlled corruption of `struct file` far harder and often triggering a panic. A reduces attack
surface but does not directly protect the object. B mitigates code-reuse but not data-only
corruption of a struct. C targets control-flow hijacks, not data-only heap corruption.
Page 4
QUIZZES 1-10 WINDOWS, LINUX, MACOS, SECURITY,
CLOUD & VIRTUALIZATION TRINE UNIVERSITY 2026
150 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Analyze OS security mechanisms (access tokens, MAC, code signing, kernel mitigations) and predict
failure modes under attack
2 Evaluate cloud and virtualization isolation models (hypervisor, container namespaces, IAM) for
privilege-escalation and lateral-movement risk
3 Synthesize cryptographic and OS-level controls to design resilient defenses against credential theft and
memory-corruption exploits
4 IS 5403 Cybersecurity
5 Operating Systems Quizzes 1
6 10 Windows
7 Linux
8 macOS
9 Security
10 Cloud & Virtualization Trine University 2026
11 Foundations of Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud &
Virtualization
12 Applied Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud & Virtualization
13 Advanced Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud & Virtualization
14 Cybersecurity - Operating Systems (Windows, Linux, macOS), Security, Cloud & Virtualization Review
ABSTRACT
Page 1
,This study document brings together 150 carefully worded exam questions drawn from IS 5403
Cybersecurity - Operating Systems Quizzes 1-10 Windows, Linux, macOS, Security, Cloud &
Virtualization Trine University 2026, with the strongest emphasis placed on Analyze OS security
mechanisms (access tokens, MAC, code signing, kernel mitigations) and predict failure modes
under attack, Evaluate cloud and virtualization isolation models (hypervisor, container
namespaces, IAM) for privilege-escalation and lateral-movement risk and Synthesize cryptographic
and OS-level controls to design resilient defenses against credential theft and memory-corruption
exploits. Every item follows the wording style and level of reasoning you meet in the real paper,
and each one is paired with a clear rationale so the correct choice is never a guess. Work through
the set at your own pace, mark the questions that slow you down, then come back to them until the
reasoning feels automatic. Learners who revise this way walk into the exam room recognising the
pattern behind the questions instead of meeting them for the first time. Keep going - steady, honest
practice is what turns a difficult paper into a comfortable pass.
Q1 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A Windows 11 host enforces Credential Guard. An attacker with local admin
dumps LSASS memory but recovers only a Kerberos TGT hash, not the cleartext
NTLM hash. Which architectural change best explains this outcome?
A. LSASS runs as a Protected Process Light (PPL) with VBS-isolated credential storage, so
secrets never reside in the LSASS address space. CORRECT
B. Credential Guard encrypts the SAM hive with DPAPI-NG, preventing LSASS from reading
local account hashes.
C. Windows Defender Application Guard blocks all memory reads by non-Microsoft signed
processes.
D. Kerberos AES keys are stored in the TPM and released only to the LSAISO process via a
sealed envelope.
RATIONALE: Credential Guard uses Virtualization-Based Security (VBS) to isolate LSA secrets
in a secure kernel, and LSASS becomes a PPL so even admin-level memory reads cannot
extract them. B confuses SAM protection with LSASS isolation; C is a browser/container control,
not a memory-read barrier; D misstates TPM key release semantics (TPM seals keys but does
not mediate LSASS reads).
Page 2
,Q2 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
On a hardened Linux server, SELinux is in enforcing mode; a web daemon
(httpd_t) attempts to write to /var/www/uploads (type httpd_sys_rw_content_t) but
is denied. The DAC permissions are 0777. Which is the most precise remediation?
A. Run `chmod 0770` to align DAC with MAC expectations.
B. Add a targeted policy module allowing httpd_t write to httpd_sys_rw_content_t, or set the file
context to a type the domain may write. CORRECT
C. Disable SELinux temporarily with `setenforce 0` to confirm the cause.
D. Add the daemon user to the `wheel` group so it inherits unconfined_t.
RATIONALE: SELinux denial is a type-enforcement (TE) issue independent of DAC; the fix is a
policy rule or correct file context. A changes DAC, which is already permissive and irrelevant to
the MAC denial. C is a diagnostic step, not a remediation, and weakens security. D misuses
group membership and would not change the domain transition.
Q3 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A macOS binary is signed with a Developer ID certificate but lacks the
`com.apple.security.cs.disable-library-validation` entitlement. At launch it attempts
to load a third-party dylib. What is the expected outcome under the hardened
runtime?
A. The dylib loads because Developer ID signatures bypass library validation.
B. The process is killed by Gatekeeper before library validation occurs.
C. Library validation fails and the dylib load is denied unless the dylib is signed by the same
Team ID or Apple. CORRECT
D. The dylib loads but is sandboxed into a separate App Sandbox container.
RATIONALE: The hardened runtime enforces library validation, requiring loaded libraries to be
signed by the same Team ID or Apple unless the disable-library-validation entitlement is present.
A is false-Developer ID does not bypass library validation. B confuses Gatekeeper (launch-time
notarization) with runtime library validation. D mischaracterizes App Sandbox, which is a
separate opt-in entitlement.
Page 3
, Q4 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A cloud IAM policy grants `sts:AssumeRole` on a role whose trust policy allows
`Principal: "*"` with condition `aws:PrincipalOrgID: o-abc123`. Which residual risk
remains despite the OrgID condition?
A. Any principal in the organization can assume the role, enabling lateral movement if a single
account is compromised. CORRECT
B. The condition is ignored for service principals, so any AWS service can assume the role.
C. OrgID conditions are evaluated only for the management account, not member accounts.
D. The role can be assumed by anonymous internet users because `Principal: "*"` overrides the
condition.
RATIONALE: The OrgID condition restricts assumption to accounts in the org, but any principal in
any member account can assume it, so a single compromised account enables lateral
movement. B is false-service principals are still subject to conditions. C is false-OrgID is
evaluated for all member accounts. D is false-conditions are conjunctive with the principal, not
overridden.
Q5 ANALYZE OS SECURITY MECHANISMS (ACCESS TOKENS, MAC, CODE SIGNING,
KERNEL MITIGATIONS) AND PREDICT FAILURE MODES UNDER ATTACK
A Linux container escapes via a kernel exploit that corrupts a `struct file` object.
Which mitigation, if enabled, would most likely have converted the corruption into
a controlled crash rather than a privilege escalation?
A. Seccomp-bpf filtering of the `io_uring` syscall.
B. Kernel Address Space Layout Randomization (KASLR) combined with SMEP/SMAP.
C. Control Flow Integrity (CFI) via Clang's `-fsanitize=cfi` for kernel modules.
D. Kernel heap hardening (SLAB_FREELIST_HARDENED,
CONFIG_SLAB_FREELIST_RANDOM) with `struct file` in a dedicated cache. CORRECT
RATIONALE: Heap hardening randomizes freelist metadata and separates caches, making
controlled corruption of `struct file` far harder and often triggering a panic. A reduces attack
surface but does not directly protect the object. B mitigates code-reuse but not data-only
corruption of a struct. C targets control-flow hijacks, not data-only heap corruption.
Page 4
