Understand process isolation, service privilege, kernel boundaries and test the resulting controls with reproducible evidence.
45 min 135 XPSkills: Process isolation, Service privilege, Kernel boundaries
Brief
Northwind Freight needs defensible evidence for operating systems, not a vocabulary quiz. Start with the system boundary and trace how a technical state changes the confidentiality, integrity or availability of the service. A passing document is not a passing running system.
You will examine process isolation, service privilege, kernel boundaries, then make short incident decisions and author a testable specification. Keep desired state, observed state and evidence separate: an approved requirement tells you what should happen, while a dated observation tells you what actually happened.
Never convert missing evidence into a passing control result.
Kernel and user space
The kernel mediates CPU scheduling, memory mappings and device access. Ordinary applications execute in user space and request privileged operations through system calls. A system call crosses a controlled interface; it does not turn the entire caller into kernel code. Drivers executing in the kernel enlarge the trusted computing base.
Virtual memory gives each process a private address space, with page permissions limiting reads, writes and execution. Isolation is not absolute: a privileged debugger, shared-memory region or kernel flaw can cross it. Threads within one process usually share mappings, so separate thread identifiers do not establish a security boundary.
Isolation supports confidentiality and integrity controls. Preserve privilege configuration and crash or protection-fault records; an auditor asks which administrative identities can inspect process memory and how that access is approved.
Kernel and user space requires both a declared boundary and independently testable observations.
Processes, services and privilege
A process is a running program with an identity, open descriptors and execution state. Its numeric process identifier can be reused after termination, so reliable evidence includes host identity and start time. A service is a managed workload with lifecycle policy; it can create several processes and continue without an interactive login.
Run a service under a dedicated noninteractive account rather than a shared administrator identity. Bind access to only the directories and operations needed, constrain resource consumption and record startup failures. Automatic restart improves availability but can create an endless crash loop if dependency ordering or configuration is wrong.
Least-privilege controls require effective runtime identities, not just configuration templates. Keep service definitions and sampled process credentials; an auditor asks whether the running workload inherited extra rights through groups or an exceptional startup wrapper.
Processes, services and privilege requires both a declared boundary and independently testable observations.
State and lifecycle
A scheduler switches execution between runnable tasks; waiting on disk is not the same as consuming CPU. Stopping a parent process may leave children running unless the service manager controls the whole process group. Graceful termination permits cleanup, whereas forced termination can interrupt writes and require recovery.
Updates may replace files without replacing already running code. A service restart or system reboot can be necessary to load new libraries or a new kernel. Verify the effective running version after the maintenance window and distinguish desired startup state from observed runtime state.
Change management needs approved maintenance scope, stop/start results and post-change health checks. An auditor asks whether the patched executable was actually in use, not simply whether an update command returned success.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: A protected boundary
Scenario sim+45 XP
Read the brief and answer both questions.
Incident brief
A developer claims every application runs inside the privileged core because it uses a system call. The application itself is ordinary unprivileged code.
Term bank, not all of these are right
kerneluser spacefirmwarebootloader
1.1Which component mediates device access and scheduling? (one word)
1.2Where does the ordinary application execute? (two words)
Task 2: The identifier trap
Scenario sim+45 XP
Read the brief and answer both questions.
Incident brief
A monitoring report reuses a numeric execution identifier after termination. The team calls that identifier a permanent workload name, even though the managed background workload starts several executions.
Term bank, not all of these are right
processservicethreadkernel
2.1What is a running program instance called? (one word)
2.2What is the managed background workload called? (one word)
Task 3: Installed but not effective
Scenario sim+45 XP
Read the brief and answer both questions.
Incident brief
New library files are installed, but the daemon keeps its old mapping until it is stopped and started. Its account also has unrelated administrator rights, which the operator calls necessary availability redundancy.
Term bank, not all of these are right
restartleast privilegereinstallshared privilege
3.1What lifecycle action loads the new service code here? (one word)
3.2What principle should constrain its rights? (two words)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
The control owner calls the current summary complete because every field has a label. Several labels confuse a technical mechanism with assurance, and missing observations have been treated as passing.
Use the fixture as the authoritative requirement. Replace the empty fields with typed, testable values and identify the evidence needed to substantiate the claim. Do not copy the owner's optimistic summary.
Approved requirement and measured facts
Worker must use a dedicated account without interactive login. Maximum process count is 64. Capture runtime process identity and start time after maintenance.
The coordinator calls every line critical because it contains security terminology. The queue includes normal observations and verified changes as well as actual defects.
Use this exercise scale: active destructive compromise is critical; a confirmed unauthorized modification path is high; an isolated test coverage gap is medium; verified-state documentation hygiene is low. Informational verified observations are noise.
List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.
Observed events with scope and impact
IT2-1 ACTIVE: attacker-controlled account is currently deleting the sole process isolation evidence copy; stop ongoing destruction.
IT2-2 EXPOSED: unauthorized users can modify service privilege configuration; exploit path confirmed, no current exploitation.
IT2-3 LIMITED: one isolated test node lacks a required kernel boundaries observation; production unaffected.
IT2-4 HYGIENE: documentation heading for process isolation is stale, but measured state and coverage are verified.
IT2-5 The kernel mediates CPU scheduling, memory mappings and device access. Verified informational baseline observation, no gap.
IT2-6 A process is a running program with an identity, open descriptors and execution state. Verified informational mechanism observation, no gap.
IT2-7 Scheduled collector heartbeat received within the approved window; no missed collection.
IT2-8 Approved maintenance completed with independent post-change evidence and no unresolved finding.
1
2
3
4
5
6
7
8
9
10
11
12
Checks
The right findings are raised
Benign lines are left out
Severity matches the actual exposure
Ranked worst first
Next on your path · IT Fundamentals
Filesystems and Permissions
Understand posix modes, acl evaluation, special bits and test the resulting controls with reproducible evidence.
