StudyXY
RegisterLog in
Information Technology /Cyber-Security: Working with Windows

Cyber-Security: Working with Windows

Information Technology46 CardsCreated about 2 months ago

This deck covers key concepts related to Windows operating systems, including file systems, encryption, virtual machines, and device drivers.

PrintEmbedImportReport

Which filename refers to the device driver that allows the OS to communicate with SCSI or ATA drives that aren’t related to the BIOS?

NTBootdd.sys
Tap or swipe ↕ to flip
Swipe ←→Navigate
SSpeak
FFocus
1/46

Key Terms

Term
Definition
Which filename refers to the device driver that allows the OS to communicate with SCSI or ATA drives that aren’t related to the BIOS?
NTBootdd.sys
Which certificate provides a mechanism for recovering files encrypted with EFS if there is a problem with the user’s original private key?
Recovery Certificate
Which filename refers to the physical address support program for accessing more than 4 GB of physical RAM?
Ntkmlpa.exe
Alternate data streams can obscure valuable evidentiary data, intentionally or by coincidence.
True
Which filename refers to a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to Ntldr?
NTDetect.com
The first 5 bytes (characters) for all MFT records are FILE.
False
Log in to view all terms

Related Flashcard Decks

Information Technology

Security+ (SY0-701): Additional Knowledge

This flashcard set explores various cybersecurity topics including credential-stuffing attacks, data classification (e.g., private data), and key disaster recovery metrics like RTO. It also highlights protective measures such as hashing for data integrity, automation support challenges, and the use of URL scanning in web filtering to prevent malware infections.

10 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 5.0 Security Program Management and Oversight

This flashcard set covers key concepts in cybersecurity governance frameworks, including centralized governance, data stewardship roles, and compliance laws like SOX. It also addresses environments supporting development and change management, as well as recovery strategies like Recovery Point Objective (RPO) to minimize data loss during system failures.

8 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 4.0 Security Operations

This flashcard set explores advanced cybersecurity practices including refining SIEM alert handling, email security protocols (DKIM, DMARC), secure authentication methods, and strategic threat-hunting. It emphasizes how to enhance incident response efficiency and leverage proactive defense techniques like maneuvering to counteract potential threats.

11 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 2.0 Threats, Vulnerabilities, and Mitigations

This deck covers key concepts related to threats, vulnerabilities, and mitigations in cybersecurity, focusing on virtual machine security.

1 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 1.0 General Security Concepts

This flashcard deck covers key concepts from the Security+ (SY0-701) exam, focusing on general security concepts such as technical and operational controls, policy enforcement, and tokenization.

6 cards
View Deck
Information Technology

Security+ (SY0-701): Lesson 16: Summarize Data Protection Part 2

This flashcard deck covers key concepts from the Security+ (SY0-701) Lesson 16, focusing on data protection methods, DLP components, and security awareness training.

25 cards
View Deck

Study Tips

  • Press F to enter focus mode for distraction-free studying
  • Review cards regularly to improve retention
  • Try to recall the answer before flipping the card
  • Share this deck with friends to study together
Cyber-Security: Working with Windows
TermDefinition
Which filename refers to the device driver that allows the OS to communicate with SCSI or ATA drives that aren’t related to the BIOS?
NTBootdd.sys
Which certificate provides a mechanism for recovering files encrypted with EFS if there is a problem with the user’s original private key?
Recovery Certificate
Which filename refers to the physical address support program for accessing more than 4 GB of physical RAM?
Ntkmlpa.exe
Alternate data streams can obscure valuable evidentiary data, intentionally or by coincidence.
True
Which filename refers to a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to Ntldr?
NTDetect.com
The first 5 bytes (characters) for all MFT records are FILE.
False
The file or folder’s MFT record provides cluster addresses where the file is stored on the drive’s partition. What are these cluster addresses called?
Data runs
Which acronym refers to the file structure database that Microsoft originally designed for floppy disks?
FAT
In the NTFS MFT, all files and folders are stored in separate records of how many bytes each?
1024
Typically, a virtual machine consists of just one file.
False
As data is added, the MFT can expand to take up 75% of the NTFS disk.
False
In Microsoft file structures, sectors are grouped to form clusters, which are storage allocation units of one or more sectors.
True
What is the name of the optional built-in encryption that Microsoft added to NTFS when Windows 2000 was introduced?
EFS
One way to examine a partition’s physical level is to use a disk editor, such as WinHex, or Hex Workshop.
True
What term refers to the number of bits in one square inch of a disk platter?
Areal density
What is on an NTFS disk immediately after the Partition Boot Sector?
MFT
What enables the user to run another OS on an existing physical computer (known as the host computer) by emulating a computer’s hardware environment?
A virtual machine
Which acronym refers to the file system that was introduced when Microsoft created Windows NT and that remains the main file system in Windows 10?
NTFS
The type of file system an OS uses determines how data is stored on the disk.
True
It’s possible to create a partition, add data to it, and then remove references to the partition so that it can be hidden in Windows.
True
When Microsoft created Windows 95, into what were initialization (.ini) files consolidated?
The registry
Drive slack includes RAM slack (found mainly in older Microsoft OSs) and file slack.
True
From a network forensics standpoint, there are no potential issues related to using virtual machines.
False
What specifies the Windows XP path installation and contains options for selecting the Windows version?
Boot.ini
What term refers to a column of tracks on two or more disk platters?
Cylinder
In NTFS, files smaller than 512 bytes are stored in the MFT.
True
Which of the following Windows 8 files contains user-specific information?
Ntuser.dat
EFS can encrypt which of the following?
Files, folders, and volumes
MFT stands for Master File Table
True
File and directory names are some of the items stored in the FAT database
True
An image of a suspect drive can be loaded on a virtual machine
True
List two features NTFS has that FAT does not
Unicode characters and better security
What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder?
The file is unencrypted automatically
A virtual cluster number represents the assigned clusters of files that are non resident in the MFT
True
Areal density refers to which of the following?
Number of bits per square inch of a disk platter
Zone bit recording is how disk manufacturers ensure that a platter's outer tracks store as much data as possible
False
How many sectors are typically in a cluster on a disk drive?
4 or more
In FAT32, a 123-KB file uses how many sectors?
246
CHS stands for cylinders, heads, and sectors
True
Device drivers contain instructions for the OS on how interface with hardware devices
True
What does the Ntuser.dat file contain?
MRU files list
In Windows 7 and later, how much data from RAM is loaded into RAM slack on a disk drive?
None of the above
Clusters in Windows always being numbering at what number?
2
What is the space on a drive called when a file is deleted?
Unallocated space
Virtual machines have which of the following limitations when running on a host computer?
Virtual machines are limited to host computer's peripheral configurations, such as mouse, keyboard, CD/DVD drives, and other devices
BIOS boot firmware was developed to provide better protection against malware than EFI does developed?
False