Questions
Answer the following questions to test your knowledge of this chapter:
- Which of these is not a post-exploitation framework?
- Cobalt Strike
- Metasploit
- ProcDump
- PowerSploit
- Windows OS credentials are stored in what process?
- LSASS
- Services
- Netstat
- credsman
- The use of Rundll32 can be observed within the Prefetch files.
- True
- False
- What type of Windows Security Event Log is indicative of a Remote Desktop Connection?
- Event ID 4625 Type 3
- Event ID 4625 Type 10
- Event ID 4624 Type 3
- Event ID 4264 Type 10