12.3 Processes, Permissions & File Systems

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

12.3 Processes, Permissions & File Systems

Key Takeaways Explain This Topic AI

A process is a running program with its own memory space; a thread is a unit of execution inside a process that shares that process's memory

Linux permission bits use rwx for owner, group, and others — often written as an octal mode such as 755 or 640

Octal digits encode r=4, w=2, x=1; add them per class (for example 7 = rwx, 5 = r-x, 0 = ---)

NTFS is the common modern Windows file system; ext4 is a common Linux filesystem — both organize files on disk but differ in features and native OS integration

Permissions and process model mistakes (world-writable secrets, confusing threads with processes) are high-value Cyber Test traps

Last updated: July 2026

Navigation commands get you to files; Windows services and shells get work done on a host. This section ties the operating-systems domain together with three concepts that appear across cyber aptitude items: how execution is organized ( processes and threads ), how Linux controls access ( rwx permissions and octal modes), and how disks store data at a high level ( NTFS vs ext4 ).

Processes vs Threads

A process is an instance of a program in execution. When you launch a browser, a terminal, or a background service, the operating system creates a process with:

Its own process ID (PID)
Its own virtual address space (memory isolation from other processes, in normal user-mode cases)
Handles/resources tracked by the OS (open files, network sockets, and so on)
At least one thread of execution

A thread is the OS's basic unit of CPU scheduling inside a process. Multiple threads in the same process share the process's memory and resources, which makes communication cheap — and also makes bugs and race conditions more dangerous.

Comparison for rapid recall:

Process Thread
What it is Running program instance Execution path within a process
Memory Typically isolated from other processes Shares memory with sibling threads
Heavyweight? More expensive to create Lighter to create/switch
Failure scope Crash often takes down the process Faulty thread can corrupt shared process state

Why cyber cares: malware may spawn extra processes to hide, or inject/create threads inside a trusted process to blend in. Performance issues may be "one process, many busy threads." On the Cyber Test, the clean distinction is enough: processes isolate programs; threads are concurrent workers inside one program.

If section 12.1's ps / top showed you which processes exist, this section explains what those listings represent .

Linux Permissions: rwx and the Three Classes

Linux (and Unix-like systems) attach an access mode to each file and directory. The classic model uses three permission bits for each of three classes:

Class Who it applies to
Owner (u) The user who owns the file
Group (g) Users in the file's group
Others (o) Everyone else

The three bits are:

Symbol Name Meaning on a regular file Meaning on a directory
r read Read file contents List directory entries
w write Modify file contents Create/delete entries (with caveats)
x execute Run file as a program/script Enter/traverse the directory ( cd into it)

A long listing ( ls -l ) shows a string like -rwxr-xr-- . Ignoring the file-type character at the front, the next nine characters are owner/group/others: rwx r-x r-- .

Directories need execute permission to be entered. This surprises newcomers: having r without x on a directory may let you see names in some cases depending on context, but you generally cannot traverse into the directory without x . For files, x means "runnable."

Octal Permission Notation

Administrators often write modes as three octal digits — one digit per class (owner, group, others). Each digit is the sum of:

Permission Value
r 4
w 2
x 1

Examples:

Octal Binary-ish bits Symbolic Common use
7 4+2+1 rwx Full access for that class
6 4+2 rw- Read/write
5 4+1 r-x Read/execute
4 4 r-- Read-only
0 0 --- No permissions

Whole-mode examples:

755 → owner rwx , group r-x , others r-x — common for executables/scripts meant to be run by others without being writable by them

644 → owner rw- , group r-- , others r-- — common for ordinary readable files
600 → owner rw- , group/others none — private files (keys, credential material)
700 → owner full, nobody else — private directories or scripts
777 → everyone everything — almost always a security smell on multi-user systems

Special bits (setuid/setgid/sticky) exist beyond the basic three digits; aptitude items usually stay with base rwx /octal. If you see a leading extra digit in advanced material, treat it as advanced — master 755/644/600 first.

Security takeaway: least privilege means granting only the classes and bits required. World-writable configs ( 666 / 777 ) and executable secrets are classic findings.

File Systems at a High Level: NTFS vs ext4

A file system defines how an operating system organizes, names, and retrieves data on storage. You do not need on-disk layout diagrams for the Cyber Test, but you should recognize the native "home" filesystems of Windows and Linux.

NTFS (Windows)

NTFS (New Technology File System) is the standard modern filesystem for Windows system volumes. High-level traits candidates should know:

Supports permissions/ACLs , encryption features (in supported configurations), compression, and large files/volumes

Integrates with Windows security identifiers and access control models

Journals metadata to improve recoverability after crashes (conceptual point: it is more resilient than older FAT-style systems)

When people say "Windows drive formatted for a normal PC install," they usually mean NTFS for the main OS volume.

ext4 (Linux)

ext4 is a widely used Linux filesystem (successor in the ext family after ext2/ext3). High-level traits:

Common default for many Linux distributions' root and data partitions
Supports journaling, large files, and extents for efficient storage of large contiguous data
Works naturally with Linux user/group permission models (the rwx world you just studied)
Contrast Without Overfitting

Topic NTFS ext4
Typical home OS Windows Linux
Permission style Windows ACLs / security descriptors Unix owner/group/others (+ ACLs possible)
Role on exam Recognize as Windows FS Recognize as common Linux FS

Cross-platform nuance (useful but keep light): Linux can often read NTFS with drivers/tools; Windows does not natively treat ext4 as a first-class citizen without extra software. Removable media may still use FAT32/exFAT for compatibility — those are different filesystems optimized for interchange, not the primary OS volumes discussed here.

Connecting the Three Topics

Put it in one workflow story:

A process (maybe with multiple threads ) runs a service that reads a config file
The file lives on ext4 (Linux) or NTFS (Windows)
On Linux, octal/ rwx permissions decide whether that process's user can read or modify the file

If permissions are wrong, the process fails closed (access denied) or fails open (anyone can read secrets). If you confuse threads with processes, you misread how isolation works. If you confuse NTFS with ext4, you misread which OS security model applies.

Study Drill

Before moving on, ensure you can:

Define process vs thread in one sentence each
Convert between a symbolic mode like rw-r----- and octal 640
Explain why x on a directory matters for cd
Name NTFS as Windows-typical and ext4 as Linux-typical

Those four checks cover the majority of processes/permissions/filesystem questions in this domain.