A Linux administrator wants to allow a specific user, 'deploy', to restart the web server service without giving them full root access. Which configuration should they implement?

Set the setuid bit on systemctl.

Add 'deploy' to the root group.

Add a sudoers entry: 'deploy ALL=(root) /usr/bin/systemctl restart nginx'

Use chmod 4755 on the nginx binary.

A company's finance department uses a shared Windows workstation. The security team needs to ensure that only the finance team's domain group can log on locally to that workstation, while still allowing domain administrators to log on for maintenance. Which Group Policy setting should be configured in a GPO linked to the workstation's OU?

Set 'Deny log on locally' to include the 'Everyone' group.

Set 'Allow log on locally' to include the finance group and 'Domain Admins'.

Configure 'User Rights Assignment' to remove 'Users' from 'Allow log on locally'.

Apply a restricted group policy to add the finance group to the local Administrators group.

A Linux administrator is hardening a server and wants to ensure that the system automatically installs security updates. Which tool should they use?

unattended-upgrades (on Debian/Ubuntu) or dnf-automatic (on RHEL/Fedora)

systemd-timer with a service that runs 'yum update -y'

manually running 'apt update && apt upgrade' weekly

cron with a script that runs 'apt upgrade -y' every day

A SOC analyst is reviewing a Windows event log and sees multiple Event ID 4625 entries from the same source IP address within a short time window. The analyst also notices that the 'Logon Type' field is 3. What does this pattern indicate?

A user is repeatedly entering the wrong password at the physical console.

A network-based brute-force attack against a Windows service, such as SMB or RDP.

A service account is being locked out due to a misconfigured service.

A scheduled task is failing to run because of a bad password.

EC-CouncilSOC Essentials

Domain 1Objective 4

Windows and Unix/Linux Security SCE Practice Questions (Page 4)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

11concepts

11 Concepts in This Objective

Windows Security Architecture
Windows Authentication and Authorization
Windows Security Policies and Group Policy
Windows Auditing and Logging
Windows Defender and Built-in Security Tools
Unix/Linux Security Architecture
Unix/Linux Authentication and PAM
Unix/Linux File Permissions and Access Control
Unix/Linux Security Hardening
Unix/Linux Auditing and Logging
Unix/Linux Security Tools

Questions 16–20

16application · medium
A Linux administrator wants to allow a specific user, 'deploy', to restart the web server service without giving them full root access. Which configuration should they implement?
Select an answer first
17application · medium
A company's finance department uses a shared Windows workstation. The security team needs to ensure that only the finance team's domain group can log on locally to that workstation, while still allowing domain administrators to log on for maintenance. Which Group Policy setting should be configured in a GPO linked to the workstation's OU?
Select an answer first
18application · easy
A Windows server is infected with ransomware that encrypts files. The security team wants to use a built-in Windows tool to roll back the encryption on files that were modified by the ransomware. Which tool should they use?
Select an answer first
19application · medium
A Linux administrator is hardening a server and wants to ensure that the system automatically installs security updates. Which tool should they use?
Select an answer first
20application · medium
A SOC analyst is reviewing a Windows event log and sees multiple Event ID 4625 entries from the same source IP address within a short time window. The analyst also notices that the 'Logon Type' field is 3. What does this pattern indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Windows and Unix/Linux Security SCE Practice Questions (Page 4)

Questions 16–20

A Linux administrator wants to allow a specific user, 'deploy', to restart the web server service without giving them full root access. Which configuration should they implement?

A Windows server is infected with ransomware that encrypts files. The security team wants to use a built-in Windows tool to roll back the encryption on files that were modified by the ransomware. Which tool should they use?

A Linux administrator is hardening a server and wants to ensure that the system automatically installs security updates. Which tool should they use?

A SOC analyst is reviewing a Windows event log and sees multiple Event ID 4625 entries from the same source IP address within a short time window. The analyst also notices that the 'Logon Type' field is 3. What does this pattern indicate?

Keep studying — Computer Network and Security Fundamentals