windows

Linux candidates often freeze here. The model is learnable in five nouns, and interviewers reward the one insight that matters: privileges in a token can matter more than group membership.

Kernel exploits make headlines; misconfigured services, impersonation and stored credentials do the work. The scored answer groups escalation into classes and attaches a control and a detection to each.

You cannot stop every laptop being compromised. You can decide what that laptop holds. The strong answer is about which credentials live where, and making stolen ones useless elsewhere.

NTLM proves you can answer a challenge. It never proves which server you meant to answer, so whoever sits in the middle can pass your answer to a server you never chose.

Once an attacker is admin on one machine, the credentials cached there decide whether they stop at one machine or reach the domain. Every control in this answer is about that step.

Two things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.

Getting in once is not enough for an attacker. Persistence is where they must leave a mark on the system, which makes it one of the best places to catch them.