OSEP Application Whitelisting Bypass Quiz

1. What does WDAC (Windows Defender Application Control) do?

Prevents execution of unauthorized applications and drivers

Scans files for virus signatures

Manages network firewall rules

Encrypts user files automatically

2. Which approach is most effective for comprehensive application whitelisting security?

Relying solely on AppLocker rules

Combining multiple layers: AppLocker, WDAC, Execution Policy, and monitoring

Using only antivirus software

Disabling all administrative tools

3. What technique involves using trusted system paths to load malicious libraries?

Path hijacking

DLL search order hijacking

Environment variable injection

Registry poisoning

4. Which registry location stores AppLocker policy information?

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2

HKEY_CURRENT_USER\Software\AppLocker

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

5. What is the purpose of Constrained Language Mode in PowerShell?

To limit script capabilities and prevent dangerous operations

To improve script execution speed

To encrypt PowerShell command history

To disable remote PowerShell access

6. Which of the following can bypass PowerShell Execution Policy restrictions?

Running PowerShell with -ExecutionPolicy Bypass flag

Encoding scripts in Base64

Using alternative shells like cmd.exe

All of the above

7. What is DLL proxying in the context of application whitelisting bypass?

Creating a malicious DLL with the same name as a legitimate one

Forwarding network traffic through a proxy server

Using a proxy application to filter DLL loading

Encrypting DLL files on disk

8. Which tool can be used to analyze and test AppLocker policies?

Event Viewer

Task Scheduler

AppLocker Policy Editor

Group Policy Management Console

9. What is the primary weakness of AppLocker rules based on publisher certificates?

They are too restrictive

Stolen or revoked certificates can still execute code

They slow down system performance

They require manual updates

10. Which bypass technique involves using COM objects to execute code?

DLL proxying

COM object instantiation

Registry modification

Environment variable hijacking

11. What is the primary purpose of application whitelisting in enterprise security?

To allow only approved applications to execute on a system

To block malware signatures

To encrypt all network traffic

To monitor user login attempts

12. Which Windows feature can be exploited to bypass execution restrictions by running scripts from alternate data streams?

NTFS alternate data streams

Shadow Copy

Volume Shadow Copy Service

Recycle Bin

13. What is the purpose of code signing in application whitelisting contexts?

To verify the authenticity and integrity of software

To encrypt sensitive data

To compress executable files

To hide malicious functionality

14. Which technique involves embedding malicious code within a legitimate file format?

Code signing

Code injection

Steganography

Polymorphism

15. What is a common bypass for AppLocker rules based on file path?

Copying whitelisted binaries to alternate locations

Using administrator credentials

Disabling Windows Defender

Modifying registry keys

16. Which PowerShell execution policy is the most restrictive?

RemoteSigned

Unrestricted

Restricted

AllSigned

17. What does AppLocker primarily control?

Network access and firewall rules

Which applications and scripts can run

User account permissions

Disk encryption status

18. Which of the following is a common Living off the Land binary used for code execution?

Notepad.exe

Msiexec.exe

Calc.exe

Explorer.exe

19. What technique involves using legitimate system tools to execute malicious code?

Privilege escalation

Living off the land

DLL injection

Code obfuscation

20. Which Windows feature allows unsigned scripts to execute if they originate from a trusted location?

Execution Policy

User Account Control

Windows Defender

Code Integrity