CNSP Dumps with Practice Exam Questions Answers

WannaCryis aransomwareattack that erupted in May 2017, infecting over 200,000 systems across 150 countries. It exploited theEternalBluevulnerability (MS17-010) in Microsoft Windows SMBv1, targeting unpatched systems (e.g., Windows XP, Server 2003). Developed by the NSA and leaked by the Shadow Brokers, EternalBlue allowed remote code execution.

Ransomware Mechanics:

Encryption:WannaCry used RSA-2048 and AES-128 to encrypt files, appending extensions like .wcry.

Ransom Demand:Displayed a message demanding $300–$600 in Bitcoin, leveraging a hardcoded wallet.

Worm Propagation:Self-replicated via SMB, scanning internal and external networks, unlike typical ransomware requiring user interaction (e.g., phishing).

Malware Context:While WannaCry is malware (malicious software), "ransomware" is the precise subcategory, distinguishing it from viruses, trojans, or spyware. Malware is a broad term encompassing any harmful code; ransomware specifically encrypts data for extortion. CNSP likely classifies WannaCry as ransomware to focus on its payload and mitigation (e.g., patching, backups).

Why other options are incorrect:

B. Malware:Correct but overly generic. WannaCry’s defining trait is ransomware behavior, not just maliciousness. Specificity matters in security taxonomy for threat response (e.g., NIST IR 8019).

Real-World Context:WannaCry crippled NHS hospitals, highlighting patch management’s criticality. A kill switch (a domain sinkhole) halted it, but variants persist.References:CNSP Official Study Guide (Malware and Exploits); Microsoft Security Bulletin MS17-010, NIST IR 8019.

The Active Directory (AD) database on Windows domain controllers contains critical directory information, stored in a specific file format.

Why D is correct:The NTDS.DIT file (NT Directory Services Directory Information Tree) is the Active Directory database file, located in C:\Windows\NTDS\ on domain controllers. It stores all AD objects (users, groups, computers) and schema data in a hierarchical structure. CNSP identifies NTDS.DIT as the key file for AD data extraction in securityaudits.

Why other options are incorrect:

A. NTDS.DAT:Not a valid AD database file; may be a confusion with other system files.

B. NTDS.MDB:Refers to an older Microsoft Access database format, not used for AD.

C. MSAD.MDB:Not a recognized file for AD; likely a misnomer.

References:CNSP "Windows Active Directory Security" (Section on Database Files) confirms NTDS.DIT as the Active Directory database file.

The Windows Registry is a hierarchical database storing configuration settings for the operating system, applications, and hardware. It’s physically stored ashive fileson disk, located in the directoryC:\Windows\System32\Config. These files are loaded into memory at boot time and managed by the Windows kernel. Key hive files include:

SYSTEM:Contains hardware and system configuration (e.g., drivers, services).

SOFTWARE:Stores software settings.

SAM:Security Accounts Manager data (e.g., local user accounts, passwords).

SECURITY:Security policies and permissions.

DEFAULT:Default user profile settings.

USERDIFFand user-specific hives (e.g., NTUSER.DAT in C:\Users<username>) for individual profiles, though these are linked to Config indirectly.

Technical Details:

Path:C:\Windows\System32\Configis the primary location for system-wide hives. Files lack extensions (e.g., "SYSTEM" not "SYSTEM.DAT") and are backed by transaction logs (e.g., SYSTEM.LOG) for recovery.

Access: Direct file access is restricted while Windows runs, as the kernel locks them. Tools like reg save or offline forensic utilities (e.g., RegRipper) can extract them.

Backup: Copies may exist in C:\Windows\System32\config\RegBack (pre-Windows 10 1803) or repair folders (e.g., C:\Windows\Repair).

Security Implications:The registry is a prime target for attackers (e.g., persistence via Run keys) and malware (e.g., WannaCry modified registry entries). CNSP likely emphasizes securing this directory (e.g., NTFS permissions) and auditing changes (e.g., via Event Viewer, Event ID 4657). Compromising these files offline (e.g., via physical access) can extract password hashes from SAM.

Why other options are incorrect:

A. C:\Windows\debug:Used for debug logs (e.g., memory.dmp) or tools like DebugView, not registry hives. It’s unrelated to core configuration storage.

C. C:\Windows\security:Contains security-related files (e.g., audit logs, policy templates), but not the registry hives themselves.

D. All of the above:Only B is correct; including A and C dilutes accuracy.

Real-World Context:Forensic analysts target C:\Windows\System32\Config during investigations (e.g., parsing SAM with Mimikatz offline).References:CNSP Official Study Guide (Windows Security Architecture); Microsoft Windows Registry Documentation.

Adding a user to a domain group like "Domain Admins" requires the correct command and scope (domain vs. local).

Why A is correct:net group "Domain Admins" John /add /domain adds user John to the domain-level "Domain Admins" group, per CNSP’s domain privilege management.

Why other options are incorrect:

B:net user creates users, not group memberships; syntax is wrong.

C:/admin is invalid; correct group specification is missing.

D:Targets local "Administrator" group, not domain "Domain Admins".

References:CNSP "Domain Administration" (Section on net Commands) validates net group with /domain.

The prefix $2a$ identifies thebcrypthashing algorithm, which is based on the Blowfish symmetric encryption cipher (developed by Bruce Schneier). Bcrypt is purpose-built for password hashing, incorporating:

Salt:A random string (e.g., 22 Base64 characters) to thwart rainbow table attacks.

Work Factor:A cost parameter (e.g., $2a$10$ means 2^10 iterations), making it computationally expensive to brute-force.

Format:$2a$[cost]$[salt][hash]

Example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

$2a$: Bcrypt variant (original is $2$; $2a$ fixes a minor bug).

$10$: 1024 iterations.

Next 22 characters: Salt.

Remaining: Hashed password.

Used in /etc/shadow on Linux, bcrypt’s adaptive nature ensures it remains secure as hardware improves. CNSP likely includes it in cryptography modules for its strength over older algorithms like MD5.

Why other options are incorrect:

B. SHA256:Part of the SHA-2 family, outputs a 64-character hexadecimal string (e.g., e3b0c442...), no $ prefix. It’s faster, less suited for passwords.

C. MD5:Produces a 32-character hex string (e.g., d41d8cd9...), no prefix. It’s cryptographically broken (collisions found).

D. SHA512:SHA-2 variant, 128-character hex (e.g., cf83e135...), no $ prefix, not salted by default.

Real-World Context:Bcrypt protects SSH keys and web app passwords (e.g., in PHP’s password_hash()).References:CNSP Official Documentation (Cryptography); Bcrypt Specification, RFC 1321 (MD5).