Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
System Security · Question Set
Hardening & Defense interview questions for placements and exams.
Questions
14
Included in this set
Subject
System Security
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for System Security.
Full-disk encryption safeguards stored data by requiring a key or passphrase before the drive contents are readable. BitLocker integrates with Windows; LUKS is the common standard on Linux. Proper key backup and recovery procedures are critical in enterprise rollouts.
Windows: manage-bde -on C: Linux: cryptsetup luksFormat /dev/sdx
For complete preparation, combine this set with full subject-wise practice for System Security. You can also explore other subjects and sets from the links below.
Sysmon (System Monitor) is a Windows service and driver that logs rich events such as process creations, network connections, and file hash data to Windows Event Log. It supports threat hunting and detection; it is not a prevention tool. Sources: Microsoft Sysinternals Sysmon documentation and practitioner guidance.
Install example (admin): sysmon64.exe -accepteula -i sysmon-config.xml
CIS Benchmarks are consensus-built hardening guides that tell you exactly how to configure operating systems, databases, and platforms to reduce attack surface. Teams use them to baseline new builds and to assess drift over time. Source: Center for Internet Security overview and vendor explanations of CIS Benchmarks and hardened images.
Example items: disable unused services; enforce password policy; configure logging; restrict insecure protocols
Secure Boot validates that firmware and boot components are trusted before the OS loads, reducing the risk of rootkits and tampered boot chains. It complements disk encryption and OS hardening in a layered defense.
Firmware setting: UEFI → Secure Boot → Enabled; enroll org keys if required
Data Execution Prevention stops executing data pages, and Address Space Layout Randomization makes memory locations unpredictable. Together they raise the bar for classic memory-safety exploits and should remain enabled as baseline hardening.
Windows: bcdedit /set nx OptOut; Linux: check randomize_va_space in /proc/sys/kernel
Disabling direct root login reduces brute-force risk and audit ambiguity. Key-based authentication is stronger than passwords and enables MFA add-ons. Combine with allowlists, modern ciphers, and fail2ban or equivalent.
In /etc/ssh/sshd_config: PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes
Host firewalls restrict inbound and outbound flows per machine, containing blast radius if an attacker lands on an endpoint. They complement, not replace, network firewalls and segmentation.
Linux (ufw): ufw default deny incoming; ufw allow 22/tcp Windows: New-NetFirewallRule -DisplayName "Allow SSH" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow
Start with a trusted image and apply a recognized benchmark such as the CIS Benchmark to set secure defaults. Disable unused services, enforce password and lockout policies, enable disk encryption, configure logging (Windows: Sysmon plus security logs; Linux: auditd and systemd-journald), and turn on host firewalls. Automate with configuration management so every server is built the same. Continuously scan for drift, patch on a risk-based cadence, and review the baseline quarterly or when major vendor updates land. This process shrinks attack surface and keeps builds consistent across fleets.
Pipeline steps: Image → CIS hardening → Join domain/IdP → Install EDR → Enable logs → Encrypt disk → Register in CM → Compliance scan
Pick native tooling (BitLocker on Windows, LUKS on Linux) and integrate with key escrow so recovery keys are backed up securely. Pilot on a small group, validate performance and recovery flows, then phase to wider groups. Enforce pre-boot authentication where risk warrants and verify that recovery keys are retrievable before enabling at scale. Document support steps, train service desk, and test lost-device and rebuild scenarios. This balances confidentiality with operational safety and prevents lock-out incidents.
Windows: enable BitLocker with escrow to Azure AD/MBAM Linux: cryptsetup luksFormat + enroll keys; store recovery in vault
Translate policies into machine-readable controls: configuration-management code, CI checks, and compliance scans aligned to CIS or internal standards. Make every change go through the same pipeline so drift is caught early. Track metrics like percentage of compliant hosts, mean time to remediate drift, and patch SLAs. Review exceptions monthly, and close them or add compensating controls. Finally, feed incident lessons back into the baseline so policy evolves with real threats. This keeps hardening alive instead of a one-time exercise.
Metrics: compliance% per control; drift tickets open>30 days; patch SLA met%
The Linux Audit system (auditd plus the kernel audit module) captures policy-relevant events like file access, authentication, and admin actions. It helps investigations and compliance by producing a tamper-evident trail. Sources: Red Hat and SUSE security guides and modern auditd explanations.
Example rule: auditctl -w /etc/passwd -p wa -k identity_changes
SELinux enforces fine-grained MAC using labels on subjects and objects. AppArmor confines programs with path-based profiles and is often easier to administer. Choosing one depends on security requirements and team expertise. Sources: comparative overviews from Linux security vendors and technical blogs.
Check mode: getenforce (SELinux); aa-status (AppArmor)
Enable Security, System, and PowerShell logs with sensible retention and forwarding. Add Sysmon for deep process, network, and file hash telemetry, using a community-vetted config to reduce noise. Forward events to a SIEM for correlation and alerting. Base detections on attack chains (for example suspicious parent-child process pairs, script block logging anomalies, unsigned binaries spawning network connections). Protect log integrity, monitor pipeline health, and routinely tune rules to balance fidelity and volume. This delivers visibility for both real-time detection and after-the-fact investigation.
WinEvent → Windows Event Forwarding/Agent → SIEM Sysmon install: sysmon64.exe -i sysmon-config.xml
Monitor identity and integrity first. Watch auth files and user/privilege changes (for example passwd, shadow, sudoers). Track use of privileged binaries and kernel settings, and record changes under /etc. Capture execve of high-risk tools like bash, netcat, ssh, and package managers. Include network connection attempts from privileged processes. Send logs off-host to a central collector and set immutable audit rules for critical systems so attackers cannot disable auditing without notice. Tune to reduce noise while preserving high-value events to keep analysts focused.
Example rules: auditctl -w /etc/sudoers -p wa -k sudo auditctl -a always,exit -F arch=b64 -S execve -k exec augenrules --load