A security team wants to prevent users from installing unauthorized software on their domain-joined Windows workstations. Which Group Policy setting should they configure?

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Installer > Prohibit User Installs

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Deny log on locally

User Configuration > Policies > Administrative Templates > Control Panel > Programs > Hide 'Programs and Features'

Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall > Block all inbound connections

In the Windows security architecture, which component is responsible for validating user credentials and generating the security token used during logon?

Security Reference Monitor (SRM)

A company wants to enforce a policy that all domain-joined Windows workstations must disable the built-in administrator account and require Ctrl+Alt+Del for logon. The security team needs to apply this centrally to all workstations in the finance department. Which approach should they use?

Use Windows Defender Firewall rules to block logon attempts to the administrator account and require Ctrl+Alt+Del.

Modify the local security policy on each workstation to disable the administrator account and require Ctrl+Alt+Del.

Create a Group Policy Object (GPO) linked to the Finance OU that sets the 'Accounts: Administrator account status' policy to disabled and the 'Interactive logon: Do not require CTRL+ALT+DEL' policy to disabled.

Run a PowerShell script on each workstation that disables the administrator account and changes the logon registry key.

A SOC analyst is investigating a Windows workstation where a user reports being unable to access a shared folder that they could access yesterday. The analyst checks the user's access token and finds that the user's group memberships have not changed, but the token still contains a group SID that was removed from the user's group membership earlier today. Which Windows security component is most likely causing the stale token?

The Windows Firewall is blocking the SMB connection because the user's group SID changed.

The access control list (ACL) on the shared folder has not been updated to reflect the group removal.

The Local Security Authority (LSA) cached the user's logon session token at sign-in and has not refreshed it.

The Security Account Manager (SAM) is still holding the old group SID in its registry database.

EC-CouncilSOC Essentials

Domain 1Objective 4

Windows and Unix/Linux Security SCE Practice Questions (Page 10)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

11concepts

11 Concepts in This Objective

Windows Security Architecture
Windows Authentication and Authorization
Windows Security Policies and Group Policy
Windows Auditing and Logging
Windows Defender and Built-in Security Tools
Unix/Linux Security Architecture
Unix/Linux Authentication and PAM
Unix/Linux File Permissions and Access Control
Unix/Linux Security Hardening
Unix/Linux Auditing and Logging
Unix/Linux Security Tools

Questions 46–49

46application · medium
A security team wants to prevent users from installing unauthorized software on their domain-joined Windows workstations. Which Group Policy setting should they configure?
Select an answer first
47foundation · easy
In the Windows security architecture, which component is responsible for validating user credentials and generating the security token used during logon?
Select an answer first
48application · medium
A company wants to enforce a policy that all domain-joined Windows workstations must disable the built-in administrator account and require Ctrl+Alt+Del for logon. The security team needs to apply this centrally to all workstations in the finance department. Which approach should they use?
Select an answer first
49application · medium
A SOC analyst is investigating a Windows workstation where a user reports being unable to access a shared folder that they could access yesterday. The analyst checks the user's access token and finds that the user's group memberships have not changed, but the token still contains a group SID that was removed from the user's group membership earlier today. Which Windows security component is most likely causing the stale token?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Windows and Unix/Linux Security SCE Practice Questions (Page 10)

Questions 46–49

A security team wants to prevent users from installing unauthorized software on their domain-joined Windows workstations. Which Group Policy setting should they configure?

In the Windows security architecture, which component is responsible for validating user credentials and generating the security token used during logon?

A company wants to enforce a policy that all domain-joined Windows workstations must disable the built-in administrator account and require Ctrl+Alt+Del for logon. The security team needs to apply this centrally to all workstations in the finance department. Which approach should they use?

Keep studying — Computer Network and Security Fundamentals