Quiz: Module 3 Assignment: The Endpoint Security Analyst Assessment Assignment Overview In Modules 1 and 2, you looked at the network from the outside. In Module 3, you went inside the machine. As a cybersecurity professional, you will spend a massive portion of your career investigating the operating systems of endpoints—checking for misconfigurations, hunting for malicious processes, and ensuring that access controls are tight. In this assignment, you will act as a Junior Endpoint Security Analyst. You will be tasked with auditing a Linux system’s file permissions, enumerating a Windows system’s local security posture, and identifying a malicious file using cryptographic hashing and threat intelligence platforms. Objective Demonstrate practical competence in navigating the Linux filesystem and modifying file permissions using chmod. Prove the ability to enumerate Windows local users, groups, and shares using built-in command-line tools. Understand the mechanics of modern malware identification by calculating cryptographic hashes and utilizing VirusTotal. Articulate the conceptual differences between legacy Antivirus and modern EDR. Part 1: Linux Filesystem & Permission Auditing (30 Points) Prerequisite: Your Kali Linux virtual machine must be running. The Scenario: A junior developer left a sensitive configuration snippet in the /tmp directory with insecure permissions. Your job is to locate it, identify the insecurity, and fix it using the Principle of Least Privilege. Your Tasks: Open your Kali terminal. Navigate to the /tmp directory. Create a new file named db_config.txt by running this exact command: echo “DB_PASSWORD=S3cur3P@ss!” > db_config.txt Check the current permissions of the file. Alter the permissions so that ONLY the owner (you) can read and write to the file. Remove all permissions for the Group and Others. Ensure the file is not executable. Deliverables for Part 1 (Provide Screenshots and Text): Screenshot 1: A clear screenshot of your terminal showing: The command you used to view the permissions of db_config.txt before you changed them. The exact chmod command you used to fix the permissions. The command you used to view the permissions after the change, proving the permissions now look like -rw——-. Question 1: In 1-2 sentences, explain why storing a file containing a plaintext password in the /tmp directory is a security risk, even if the permissions are locked down. Part 2: Windows Security Enumeration (30 Points) Prerequisite: You need access to a Windows 10/11 machine (a personal PC or a Windows VM). The Scenario: You are performing a routine security audit on a Windows workstation. You need to document exactly who has administrative access and what resources are being shared on the local network. Your Tasks: Open the Command Prompt as an Administrator (Start -> type cmd -> Right-click -> Run as Administrator). Execute the necessary commands to discover your current username and its group memberships. Execute the necessary command to list all accounts that have God-mode (Administrator) access to this specific machine. Deliverables for Part 2 (Provide Screenshots and Text): Screenshot 2: A screenshot of your Windows Command Prompt showing the output of the command used to list the members of the local Administrators group. Question 2: According to the module, what is the specific difference between a Pass-the-Hash attack (associated with NTLM) and a Golden Ticket attack (associated with Kerberos)? Which piece of Active Directory infrastructure must be compromised to execute a Golden Ticket attack? Part 3: Malware Fingerprinting & Threat Intelligence (25 Points) Prerequisite: A web browser and a terminal (Kali Linux, Mac Terminal, or Windows PowerShell). The Scenario: A suspicious file was found on an endpoint. Before you attempt to open it, you must identify it safely using hashing and OSINT (Open Source Intelligence). Your Tasks: The Avalanche Effect: In your terminal, create a file named original.txt containing the text CompanyFinances2023. Calculate its SHA-256 hash. Now, change the text to CompanyFinances2024 and calculate the hash again. The EICAR Test: Recreate the safe, industry-standard EICAR test file in your terminal using the echo command provided in the lesson: echo ‘X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*’ > eicar.txt Calculate the SHA-256 hash of the eicar.txt file. Take that SHA-256 hash and search for it on VirusTotal.com. Deliverables for Part 3 (Provide Text Responses): Question 3: Paste the two different SHA-256 hashes for original.txt and original.txt (with the changed year). Does this demonstrate the Avalanche Effect? (Yes/No). Question 4: What is the exact SHA-256 hash of the eicar.txt file you generated? Question 5: When you look up the EICAR hash on VirusTotal, how many of the vendors flagged it as malicious (e.g., what was the Detection ratio like 60/70)? Question 6: If a hacker uses a polymorphic engine to scramble the code of a virus so its hash changes every time it spreads, why will traditional Signature-Based Antivirus fail to catch it, and how does EDR (Endpoint Detection and Response) successfully catch it instead? Part 4: The Consultant’s Pitch (15 Points) In Lesson 3.1, we discussed the epidemic of cloud data breaches caused by Linux permission misconfigurations (like leaving AWS S3 buckets publicly readable). In Lesson 3.3, we learned that traditional Antivirus is mostly useless against modern attacks. Your Task: Write a short, 4-5 sentence “Cold Email” pitch to the owner of a mid-sized local business (e.g., a regional accounting firm that stores client tax records in the cloud). Goal: Convince them to hire you for a $200 “Endpoint & Cloud Storage Security Audit.” Requirement: You must explicitly mention the danger of relying solely on traditional Antivirus, AND mention the risk of improper file permissions exposing their data to the internet. Translate these technical concepts into business risks (fines, leaked client data, reputational damage) that a non-technical business owner would understand. Submission Checklist (Before you submit, ensure you have:) Screenshot 1: Linux terminal showing the db_config.txt permissions before and after the chmod fix. Text answer explaining the risk of /tmp. Screenshot 2: Windows CMD showing the local Administrators group membership. Text answer explaining Pass-the-Hash vs. Golden Ticket. Text answer with the two hashes demonstrating the Avalanche Effect. Text answer with the exact SHA-256 hash of the EICAR file. Text answer with the VirusTotal detection ratio for EICAR. Text answer explaining why AV fails against polymorphic malware and how EDR catches it. A 4-5 sentence cold email pitching an Endpoint/Cloud audit. Instructor Evaluation Rubric (How you will be graded) Technical Execution (35%): Did the student successfully navigate the Linux filesystem? Did they use the correct chmod syntax to achieve the exact -rw——- permission state? Did they successfully use the correct Windows commands (net localgroup administrators)? Analytical Accuracy (35%): Does the student accurately describe the difference between NTLM and Kerberos attacks? Do they correctly explain the mechanics of the Avalanche Effect and the operational differences between Signature-Based AV and EDR? Threat Intelligence Application (15%): Did the student successfully generate the EICAR hash and accurately report the VirusTotal findings? Business Communication (15%): Does the cold email professionally translate technical flaws (AV limitations, permission misconfigurations) into compelling business risks that would motivate a client to purchase an audit? (Note for LMS Admin: Set this up as a “File Upload” assignment where students compile their screenshots and text answers into a single PDF or Word Document). - The Acinge Network
Skip to content
