The SecOps Group CNSP Exam Dumps

The net localgroup command manages local group memberships on Windows systems, with syntax dictating its action.

Why B is correct: net localgroup Sales Sales_domain /add adds the domain group Sales_domain to the local group Sales, granting its members local group privileges. CNSP covers this for privilege escalation testing.

Why other options are incorrect:

A: Displaying users requires net localgroup Sales without /add.

C: Adding a user requires a username, not a group name like Sales_domain.

D: The reverse (local to domain) uses net group, not net localgroup.

Address spoofing fakes a source address (e.g., IP, MAC) to impersonate or amplify attacks. Analyzing protocol resilience:

C . TCP (Transmission Control Protocol):

Mechanism: Three-way handshake (SYN, SYN-ACK, ACK) verifies both endpoints.

Client SYN (Seq=X), Server SYN-ACK (Seq=Y, Ack=X+1), Client ACK (Ack=Y+1).

Spoofing Resistance: Spoofer must predict the server's sequence number (randomized in modern stacks) and receive SYN-ACK, impractical without session hijacking or MITM.

Correct Implementation: RFC 793-compliant, with anti-spoofing (e.g., Linux tcp_syncookies).

A . UDP:

Connectionless (RFC 768), no handshake. Spoofed packets (e.g., source IP 1.2.3.4) are accepted if port is open, enabling reflection attacks (e.g., DNS amplification).

B . ARP (Address Resolution Protocol):

No authentication (RFC 826). Spoofed ARP replies (e.g., fake MAC for gateway IP) poison caches, enabling MITM (e.g., arpspoof).

D . IP:

No inherent validation at Layer 3 (RFC 791). Spoofed source IPs pass unless filtered (e.g., ingress filtering, RFC 2827).

Security Implications: TCP's handshake makes spoofing harder, though not impossible (e.g., blind spoofing with sequence prediction, mitigated since BSD 4.4). CNSP likely contrasts this with UDP/IP's vulnerabilities in DDoS contexts.

Why other options are incorrect:

A, B, D: Lack handshake or authentication, inherently spoofable.

Real-World Context: TCP spoofing was viable pre-1990s (e.g., Mitnick attack); modern randomization thwarts it.

The net command in Windows is a legacy tool for managing users, groups, and network resources. The subcommand net localgroup <groupname> displays information about a specified local group on the machine where it's run. Specifically:

net localgroup administrators lists all members (users and groups) of the local Administrators group on the current computer.

The local Administrators group grants elevated privileges (e.g., installing software, modifying system files) on that machine only, not domain-wide.

Output Example:

Alias name administrators

Comment Administrators have complete and unrestricted access to the computer

Members

-------------------------------------------------------------------------------

Administrator

Domain Admins

The command completed successfully.

Technical Details:

Local groups are stored in the Security Accounts Manager (SAM) database (e.g., C:\Windows\System32\config\SAM).

This differs from domain groups (e.g., Domain Admins), managed via Active Directory.

Security Implications: Enumerating local admins is a reconnaissance step in penetration testing (e.g., to escalate privileges). CNSP likely covers this command for auditing and securing Windows systems.

Why other options are incorrect:

A . List domain admin users for the current domain: This requires net group 'Domain Admins' /domain, which queries the domain controller, not the local SAM. net localgroup is strictly local.

Real-World Context: Attackers use this command post-compromise (e.g., via PsExec) to identify privilege escalation targets.

Windows stores password hashes in the SAM (Security Account Manager) file, with a consistent location across 32-bit and 64-bit systems.

Why B is correct: The SAM file resides at C:\Windows\System32\config\SAM, locked during system operation for security. CNSP notes this for credential extraction risks.

Why other options are incorrect:

A: System64 does not exist; System32 is used even on 64-bit systems.

C: C:\System64 is invalid; the path starts with Windows.

D: config\System32 reverses the correct directory structure.

SSH (Secure Shell), per RFC 4251, uses asymmetric cryptography (e.g., RSA, ECDSA) for secure authentication:

Key Pair:

Public Key: Freely shareable, used to encrypt or verify.

Private Key: Secret, used to decrypt or sign.

Process:

User generates a key pair (e.g., ssh-keygen -t rsa -b 4096).

Public Key is uploaded to the server, appended to ~/.ssh/authorized_keys (e.g., via ssh-copy-id).

Private Key (e.g., ~/.ssh/id_rsa) stays on the user's machine.

Authentication: Client signs a challenge with the private key; server verifies it with the public key.

Technical Details:

Protocol: SSH-2 (RFC 4253) uses a Diffie-Hellman key exchange, then public-key auth.

Files: authorized_keys (server, 0644 perms), private key (client, 0600 perms).

Security: Private key exposure compromises all systems trusting the public key.

Security Implications: CNSP likely stresses key management (e.g., passphrases, rotation) and server-side authorized_keys hardening (e.g., PermitRootLogin no).

Why other options are incorrect:

B: Uploading the private key reverses the model, breaking security---anyone with the server's copy could authenticate as the user. Asymmetric crypto relies on the private key remaining secret.

Real-World Context: GitHub uses SSH public keys for repository access, with private keys on user devices.