nerdexam
CompTIA

CAS-001 · Question #275

Which of the following are examples of privilege escalation? Each correct answer represents a complete solution. Choose two.

The correct answer is A. John logs in as a standard user but uses a flaw in the system to get admin privilege D. Juan logs in with his account, then takes over Anita's privileges. Privilege escalation occurs when a user gains permissions beyond those originally assigned, either vertically by reaching higher privilege levels or horizontally by assuming another user's access.

Enterprise Security

Question

Which of the following are examples of privilege escalation? Each correct answer represents a complete solution. Choose two.

Options

  • AJohn logs in as a standard user but uses a flaw in the system to get admin privilege
  • BFred uses Ophcrack to get a Windows XP password
  • CJohn uses SQL commands to login to a website he does not have authorization to.
  • DJuan logs in with his account, then takes over Anita's privileges

How the community answered

(42 responses)
  • A
    74% (31)
  • B
    19% (8)
  • C
    7% (3)

Why each option

Privilege escalation occurs when a user gains permissions beyond those originally assigned, either vertically by reaching higher privilege levels or horizontally by assuming another user's access.

AJohn logs in as a standard user but uses a flaw in the system to get admin privilegeCorrect

A standard user exploiting a system flaw to obtain administrator rights is vertical privilege escalation - gaining a higher privilege tier than authorized.

BFred uses Ophcrack to get a Windows XP password

Using Ophcrack to crack a Windows password is a credential-cracking attack, not privilege escalation - it is an attempt to authenticate as another user, not to elevate an existing session's permissions.

CJohn uses SQL commands to login to a website he does not have authorization to.

Using SQL injection to bypass a login form is an authentication bypass attack, not privilege escalation, because no authenticated session is being elevated.

DJuan logs in with his account, then takes over Anita's privilegesCorrect

Juan taking over Anita's account privileges is horizontal privilege escalation - gaining the rights of a peer user at the same privilege level without authorization.

Concept tested: Horizontal and vertical privilege escalation techniques

Source: https://attack.mitre.org/tactics/TA0004/

Topics

#privilege escalation#access control#authentication bypass#lateral movement

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-001 Practice