Detailed Explanations for Questions 101-125
Q101. What is the major vulnerability of an ARP request?
- A. It sends out an address request to all the hosts on the LAN.
- B. The address is returned with a username and password in cleartext.
- C. The address request can cause a DoS.
- D. The address request can be spoofed with the attacker’s MAC address. ✓
Why D is correct: ARP (Address Resolution Protocol) has no authentication mechanism. Any device on the local network can send an unsolicited ARP reply claiming to own any IP address, enabling ARP spoofing/poisoning attacks. Attackers can redirect traffic by associating their MAC address with a legitimate IP address (like the default gateway), allowing them to intercept, modify, or drop traffic.
Why others are incorrect:
- A: Broadcasting ARP requests is by design for the protocol to function—it’s not a vulnerability, just how ARP discovers MAC addresses
- B: ARP only maps IP addresses to MAC addresses; it never transmits usernames or passwords
- C: While ARP flooding could theoretically cause issues, ARP requests themselves don’t cause DoS; this confuses the protocol with attack techniques
Q102. Where is the password file located on a Windows system?
- A. C:\Windows\temp
- B. C:\Win\system\config
- C. C:\Windows\accounts\config
- D. C:\Windows\system32\config ✓
Why D is correct: The SAM (Security Account Manager) database file, which contains hashed user passwords and account information, is located at C:\Windows\system32\config\SAM. This file is locked by the operating system when Windows is running and requires special techniques to access.
Why others are incorrect:
- A:
C:\Windows\tempis used for temporary files, not credential storage - B:
C:\Win\system\configuses incorrect path syntax (missing “dows” and incorrect structure) - C:
C:\Windows\accounts\configis not a valid Windows directory structure
Q103. In the Windows SAM file, what security identifier would indicate to the adversary that a given account is an administrator account?
- A. 500 ✓
- B. 1001
- C. ADM
- D. ADMIN_500
Why A is correct: RID (Relative Identifier) 500 is the well-known, hardcoded identifier for the built-in Administrator account in Windows. This value is consistent across all Windows installations and cannot be changed, making it a reliable indicator for attackers identifying privileged accounts.
Why others are incorrect:
- B: RID 1001 is typically assigned to the first user-created account, not the built-in administrator
- C: “ADM” is not a valid RID format; RIDs are numeric values appended to the domain SID
- D: “ADMIN_500” is not valid RID syntax; RIDs are purely numeric identifiers
Q104. What command would the adversary use to show all the systems within the domain using the command-line interface in Windows?
- A. netstat -R/domain
- B. net view/<domain_name>:domain
- C. net view/domain:<domain_name> ✓
- D. netstat/domain:<domain_name>
Why C is correct: The correct Windows command syntax is net view /domain:<domain_name>, which queries the domain controller to enumerate and list all computers joined to that specific domain. This is valuable for attackers mapping the target network.
Why others are incorrect:
- A:
netstatdisplays network statistics and connections; it doesn’t enumerate domain systems, and the syntax-R/domainis invalid - B: The colon placement is incorrect; the proper syntax uses
/domain:before the domain name - D:
netstatdoesn’t support domain enumeration, and the syntax/domain:<domain_name>is invalid for this command
Q105. In Linux, what file allows you to see user information such as full name, phone number, and office information?
- A. Shadow file
- B. Passwd file ✓
- C. Userinfo file
- D. Useraccount file
Why B is correct: The /etc/passwd file contains user account information including username, UID, GID, home directory, default shell, and the GECOS field—which can store the user’s full name, phone number, office location, and other administrative details.
Why others are incorrect:
- A:
/etc/shadowcontains password hashes and password policy information, not user descriptive fields - C:
/etc/userinfois not a standard Linux file - D:
/etc/useraccountis not a standard Linux file
Q106. In Linux, what designator is used to uniquely identify a user account?
- A. GID
- B. SID
- C. UID ✓
- D. PID
Why C is correct: UID (User ID) is the unique numerical identifier assigned to each user account in Linux. The kernel uses UIDs (not usernames) for permission checking and access control. UID 0 is reserved for root.
Why others are incorrect:
- A: GID (Group ID) identifies groups, not individual user accounts
- B: SID (Security Identifier) is a Windows concept for identifying security principals
- D: PID (Process ID) identifies running processes, not user accounts
Q107. In Linux, which of the following accounts denotes the administrator?
- A. Admin
- B. Administrator
- C. root ✓
- D. su
Why C is correct: The root account is the default superuser/administrator account in Linux with UID 0 and unrestricted system privileges. All Linux systems have this account by default.
Why others are incorrect:
- A: “Admin” is not the standard Linux administrator account name (though it could be created as a regular user)
- B: “Administrator” is the default Windows administrator account name
- D:
suis a command to switch users, not an account name
Q108. Where are logs located on Linux systems?
- A. /home/log
- B. /var/log ✓
- C. /log/
- D. /home/system32/log
Why B is correct: Linux system logs are stored in /var/log, which contains files like syslog, auth.log, kern.log, secure, and application-specific logs. This is the standard location defined by the Filesystem Hierarchy Standard.
Why others are incorrect:
- A:
/home/logis not a standard Linux directory;/homecontains user home directories - C:
/log/is not a standard Linux directory - D:
/home/system32/logmimics Windows path structure and doesn’t exist in Linux
Q109. What command can you use to switch to a different user in Linux?
- A. swu
- B. user
- C. sudo
- D. su ✓
Why D is correct: The su (switch user) command allows switching to another user account. su - username provides a login shell with that user’s environment. Without arguments, su switches to root.
Why others are incorrect:
- A:
swuis not a valid Linux command - B:
useris not a command for switching users - C:
sudoallows running specific commands as another user but doesn’t switch the interactive session
Q110. What directory holds the basic commands in the Linux OS?
- A. /etc
- B. /bin ✓
- C. /
- D. /config
Why B is correct: The /bin directory contains essential binary executables required for basic system operation, including commands like ls, cp, mv, cat, bash, etc. These are needed even in single-user mode.
Why others are incorrect:
- A:
/etccontains system configuration files, not executable commands - C:
/is the root of the filesystem, not specifically for commands - D:
/configis not a standard Linux directory
Q111. Which of the following denotes the root directory in Linux OS?
- A. \
- B. / ✓
- C. C:\
- D. root/
Why B is correct: The forward slash / represents the root directory in Linux filesystems. All directories and files branch from this single root in the hierarchical filesystem structure.
Why others are incorrect:
- A:
\is the path separator and root indicator in Windows, not Linux - C:
C:\is the root of the C: drive in Windows - D:
root/would refer to a directory named “root” in the current location, not the filesystem root
Q112. In Linux, where is the password file stored?
- A. /etc/passwd
- B. /etc/shadow ✓
- C. /etc/user/password
- D. /shadow/etc
Why B is correct: The /etc/shadow file contains the actual password hashes for user accounts and is readable only by root. This separation from /etc/passwd (which is world-readable) enhances security through shadow passwords.
Why others are incorrect:
- A:
/etc/passwdcontains user account information but NOT password hashes on modern systems (historically it did) - C:
/etc/user/passwordis not a standard Linux file - D:
/shadow/etcis an invalid path structure
Q113. What file within the Linux OS contains administrative information about a user?
- A. /etc/shadow
- B. /etc/passwd ✓
- C. /home
- D. /home/profile
Why B is correct: The /etc/passwd file contains administrative user information: username, UID, GID, home directory, default shell, and the GECOS field (full name, office, phone). This is the primary source for user account metadata.
Why others are incorrect:
- A:
/etc/shadowcontains password hashes and aging information, not descriptive user data - C:
/homeis a directory containing user home directories, not a file with account information - D:
/home/profileis not a standard Linux file
Q114. What command has been used to display the network configuration in Linux OS?
- A. ipconfig
- B. netstat
- C. ls
- D. ifconfig ✓
Why D is correct: ifconfig (interface configuration) is the traditional Linux command to display network interface parameters like IP address, netmask, broadcast address, and MAC address. (Note: Modern systems may use ip addr instead.)
Why others are incorrect:
- A:
ipconfigis the Windows command for network configuration - B:
netstatshows active network connections and statistics, not interface configuration details - C:
lslists directory contents, unrelated to network configuration
Q115. In Windows, what is the command to display the ARP cache?
- A. ifconfig/-a
- B. arp -a ✓
- C. -a arp
- D. ipconfig/arp -a
Why B is correct: The arp -a command in Windows displays the current ARP cache table, showing IP-to-MAC address mappings learned on the local network. This is useful for detecting ARP spoofing attacks.
Why others are incorrect:
- A:
ifconfigis a Linux command; the syntax/-ais invalid for Windows - C:
-a arphas invalid syntax; command-line flags follow the command name - D:
ipconfigdoesn’t have an ARP subcommand; this syntax is invalid
Q116. What utility is used to gather information about NetBIOS configurations on Windows systems?
- A. netstat
- B. Nmap
- C. nbtstat ✓
- D. Ping
Why C is correct: nbtstat is a Windows-specific utility designed to display NetBIOS over TCP/IP statistics, NetBIOS name tables, name cache, and session information. It’s essential for enumerating Windows network resources.
Why others are incorrect:
- A:
netstatshows TCP/UDP connections and listening ports, not NetBIOS-specific information - B: Nmap can probe NetBIOS services but isn’t specifically designed for NetBIOS configuration enumeration
- D:
pingsends ICMP echo requests to test connectivity, unrelated to NetBIOS
Q117. What tool could you use on a Windows system to collect information about the Windows network, including the workgroup or domain you are connected to?
- A. ipconfig
- B. netstat
- C. MSConfig
- D. nbtstat ✓
Why D is correct: nbtstat -n displays the local NetBIOS name table, which includes the computer name, workgroup, or domain membership. nbtstat -A <IP> can query remote systems for the same information.
Why others are incorrect:
- A:
ipconfigshows IP configuration but doesn’t display workgroup or domain membership details - B:
netstatshows active network connections, not domain/workgroup information - C:
MSConfigmanages system startup and services, not network enumeration
Q118. Which of the following services is associated with TCP port 389?
- A. LDAP ✓
- B. IMAP
- C. SMB
- D. RPC
Why A is correct: LDAP (Lightweight Directory Access Protocol) uses TCP/UDP port 389 for directory services queries, authentication, and management operations. It’s commonly used with Active Directory and other directory services.
Why others are incorrect:
- B: IMAP (Internet Message Access Protocol) uses port 143 (or 993 for SSL/TLS)
- C: SMB (Server Message Block) uses ports 139 (NetBIOS session) and 445 (direct SMB over TCP)
- D: RPC (Remote Procedure Call) uses dynamic ports assigned by the portmapper (port 135)
Q119. Which of the following services is associated with TCP port 389?
- A. LDAP ✓
- B. IMAP
- C. SMB
- D. RPC
(Duplicate of Q118 – same explanation applies)
Q120. What port number is used by NetBIOS for name services?
- A. UDP port 137 ✓
- B. TCP port 139
- C. UDP port 190
- D. None
Why A is correct: NetBIOS Name Service (NBNS) uses UDP port 137 for name registration, resolution queries, and name release operations. This is the port used for mapping NetBIOS names to IP addresses.
Why others are incorrect:
- B: TCP port 139 is used for NetBIOS Session Service (connection-oriented communication), not name services
- C: UDP port 190 is used for SSDP (Simple Service Discovery Protocol), part of UPnP
- D: NetBIOS does use specific, well-defined ports, so “None” is incorrect
Q121. What three services are usually included with the NetBIOS protocol?
- A. NBT, NetBIOS session, and NetBIOS datagram ✓
- B. NBT, asymmetric session, and NetBIOS datagram
- C. NetBIOS datagram, NBT, and NetBIOS AD
- D. NetBIOS datagram, NBT, and NetBIOS SCP
Why A is correct: NetBIOS over TCP/IP (NBT) includes three distinct services:
- Name Service (UDP 137): Name registration and resolution
- Datagram Service (UDP 138): Connectionless communication for broadcasts
- Session Service (TCP 139): Connection-oriented communication for reliable data transfer
Why others are incorrect:
- B: “Asymmetric session” is not a NetBIOS service term
- C: “NetBIOS AD” is not a real NetBIOS service
- D: “NetBIOS SCP” is not a real NetBIOS service
Q122. Which of the following are not objects in Active Directory?
- A. Users
- B. Computers
- C. Printers
- D. Files ✓
Why D is correct: Files are stored in the filesystem (NTFS), not as Active Directory objects. AD manages directory objects like users, computers, groups, printers, OUs, and GPOs, but individual files are not AD objects.
Why others are incorrect:
- A: Users are core AD objects representing human accounts
- B: Computers are AD objects representing domain-joined machines
- C: Printers can be published as AD objects for easy discovery and management
Q123. What sets up a null session using Windows?
- A. ftp://yourdomain.com
- B. C$\yourdomain.com
- C. net use \yourdomain\ipc$ “” /user:”” ✓
- D. netcat yourdomain
Why C is correct: The command net use \\target\ipc$ "" /user:"" establishes a null session (anonymous connection) to the IPC$ (Inter-Process Communication) share on a Windows system. This allows enumeration of shares, users, and other information without authentication on vulnerable systems.
Why others are incorrect:
- A:
ftp://is an FTP URL scheme, not a command for establishing null sessions - B:
C$is an administrative share, but this syntax doesn’t establish a null session - D:
netcatis a network utility for reading/writing data across connections, not for establishing Windows null sessions
Q124. Which of the following is the protocol used by Microsoft Windows systems for authentication from one system to another?
- A. SESAME
- B. Diameter
- C. Kerberos ✓
- D. HIDS
Why C is correct: Kerberos is the default authentication protocol used by Windows domains (Active Directory) for authenticating users and services across the network. It uses tickets issued by the Key Distribution Center (KDC) to provide secure, mutual authentication.
Why others are incorrect:
- A: SESAME is a European research project for secure authentication, not used by Windows
- B: Diameter is an AAA protocol used in telecommunications networks, not Windows authentication
- D: HIDS stands for Host-based Intrusion Detection System, which is a security monitoring tool, not an authentication protocol
Q125. In Kerberos, which ticket is presented to a server to grant access to a service?
- A. TGS ✓
- B. KDC
- C. TGT
- D. AS
Why A is correct: The Ticket-Granting Service (TGS) ticket is presented to the target server to gain access to a specific service. The authentication flow is:
- Client authenticates to AS and receives TGT
- Client presents TGT to TGS to request service ticket
- TGS issues service ticket (TGS ticket) for the specific server
- Client presents TGS ticket to the target server for access
Why others are incorrect:
- B: KDC (Key Distribution Center) is the server infrastructure that issues tickets, not a ticket itself
- C: TGT (Ticket-Granting Ticket) is used to request service tickets from the TGS, not presented to the final service server
- D: AS (Authentication Server) is the component of the KDC that performs initial user authentication, not a ticket
Key Takeaways for Module 4: Enumeration
- Windows Enumeration: Master commands like
net view,nbtstat,net usefor domain and share enumeration. Know SAM location (C:\Windows\system32\config) and RID values (500 = Administrator). - Linux Enumeration: Understand
/etc/passwdvs/etc/shadow, UID/GID concepts, root account,/var/logfor logs,/binfor commands, andifconfig/sucommands. - NetBIOS Services: Remember the three services (Name/137, Datagram/138, Session/139) and that
nbtstatis the Windows tool for enumeration. - ARP Vulnerabilities: ARP has no authentication—any device can spoof responses. This enables MITM attacks via ARP poisoning.
- Kerberos Flow: Understand the ticket hierarchy: AS → TGT → TGS → Service Ticket → Access. Know which ticket is used at each stage.
- Port Knowledge: Memorize key ports: LDAP/389, NetBIOS name/137, NetBIOS session/139, SMB/445.
- Active Directory Objects: Users, computers, groups, printers are AD objects; files are filesystem objects.
- Null Sessions: The
net use \\target\ipc$ "" /user:""command establishes anonymous connections for enumeration on vulnerable systems.
Study Tip: Practice enumeration commands in a lab environment. Use
nbtstat,net view,net useon Windows VMs andcat /etc/passwd,ifconfig,suon Linux VMs. Use Wireshark to capture and analyze ARP, NetBIOS, and Kerberos traffic to understand the protocols in action.
