Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
System Security · Question Set
Sec Tools interview questions for placements and exams.
Questions
17
Included in this set
Subject
System Security
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for System Security.
Hashcat is an advanced, multi-platform password recovery tool that uses CPU and GPU acceleration and multiple attack modes to test or recover passwords at scale.
hashcat -m 1000 hashes.txt wordlist.txt -r rules/best64.rule
For complete preparation, combine this set with full subject-wise practice for System Security. You can also explore other subjects and sets from the links below.
Auditd is the userspace component of the Linux Auditing System. With kernel audit rules, it records security-relevant events, such as file writes, privilege use, and syscalls, to an immutable log. During an incident, responders pull targeted aureport and ausearch results for key paths, sensitive syscalls, and identity changes, then correlate with endpoint and network logs. This timeline shows what changed, who did it, and when.
auditctl -w /etc/passwd -p wa -k id_change ausearch -k id_change | aureport -f -i
Zeek, formerly Bro, is a passive network security monitor that generates detailed logs and enables custom analysis beyond simple signatures, supporting investigations and hunting.
Outputs: conn.log, http.log, dns.log for timeline and pivoting
Volatility is an open-source framework for memory forensics. Analysts use it to extract processes, network artifacts, injected code, and other volatile evidence from RAM captures.
vol.py -f mem.raw windows.pslist
YARA lets researchers create rule-based patterns to find related malware in files or memory. It is widely used for hunting and triage.
rule find_rundll32 { strings: $a = "rundll32" nocase condition: $a }ZAP, the Zed Attack Proxy, is a widely used open-source web security scanner and proxy with automation options and a community add-on marketplace.
zap-cli quick-scan --self-contained --spider --scanners all https://target.local
Osquery lets you query endpoints like a database using standard SQL to retrieve processes, users, sockets, and more. It is cross-platform and designed for analytics and monitoring.
SELECT pid, name, path FROM processes WHERE name='powershell.exe';
Suricata provides high-performance network intrusion detection and prevention and network security monitoring. It is developed by the Open Information Security Foundation.
suricata -c /etc/suricata/suricata.yaml -i eth0
Wireshark is a protocol analyzer that captures packets and lets you examine them in detail. It is widely used for troubleshooting, investigations, and protocol learning.
tshark -i eth0 -f "tcp port 443" -w capture.pcapng
Burp Suite is a PortSwigger platform for hands-on web testing. It acts as an intercepting proxy, supports manual probing, and can automate DAST-style scans with add-ons from its marketplace.
Proxy: set browser to 127.0.0.1:8080, intercept on → modify request → forward
Snort is a free, open-source IDS and IPS that performs real-time traffic analysis and packet logging using a powerful rule language.
alert tcp any any -> 10.0.0.5 22 (msg:"SSH scan"; flags:S; sid:1000001; rev:1;)
Nmap, the Network Mapper, is best known for fast and flexible port scanning, service and version detection, host discovery, and OS fingerprinting. It helps you map an attack surface before deeper testing.
nmap -sV -O -Pn 10.10.10.10
Nessus from Tenable scans networks, systems, and applications for known vulnerabilities and misconfigurations, then provides reports and remediation guidance.
Typical flow: discovery scan → credentialed scan → review CVEs → export report
OpenVAS is the scanner component of Greenbone Vulnerability Management, supporting authenticated and unauthenticated tests across many protocols with a frequently updated feed.
Run full and fast scan → validate findings → compare with credentialed results
Sysmon is a Sysinternals service and driver that persists across reboots and writes rich security-relevant events to the Windows Event Log, such as process creation and network connections.
sysmon.exe -i sysmonconfig.xml // then ship Microsoft-Windows-Sysmon/Operational
Start broad with Zeek to get rich connection, DNS, and HTTP logs that summarize flows and give a fast timeline for beacon patterns. Use Suricata or Snort when you want signature-based alerts, real-time detection, or IPS blocking on known indicators. Drop to Wireshark when you need packet-level ground truth to decode protocols, confirm payloads, or extract files. In practice, teams combine all three to move from signals to deep proof.
Zeek: zeek -i eth0 Suricata: eve.json alerts Wireshark: follow TCP stream to verify payload
Burp Suite shines for deep manual testing using intercept, repeater, intruder, and its ecosystem, while also offering automated scans. ZAP is a strong free option for proxying, spidering, and automation pipelines with community add-ons. For quick CI checks or budget-constrained teams, ZAP automation is great. For advanced manual exploitation and commercial reporting, Burp Pro is often preferred. Many assessors keep both.
ZAP automation: zap-baseline.py -t https://app.local Burp: Proxy on, send to Repeater, craft request