An organization suspects that a compromised admin account was used to create a new user and add it to the Domain Admins group. Which audit log should be reviewed first to confirm this activity?

Application log from the domain controller.

DNS logs for queries made by the admin's workstation.

Firewall logs showing outbound connections from the admin's workstation.

Security event log with directory service changes auditing enabled.

A large enterprise wants to implement just-in-time administration for its 200 servers. The security team requires that every elevation be approved by a manager, time-limited, and fully audited. The operations team is concerned about delays during emergencies. Which solution best balances security and operational needs?

Grant all administrators permanent local admin rights on all servers and rely on MFA.

Implement a PAM solution with an approval workflow that includes an emergency break-glass process with post-incident review.

Require manager approval for every access, including emergencies, with no exception.

Use a shared admin account with a known password for emergency access, without logging.

What is a primary risk associated with domain administrator accounts?

They can access and control all systems and users in the domain.

They are automatically rotated every 30 days.

They are limited to a single local machine.

They cannot be used for interactive logon.

An organization is reviewing its administrative access controls. The security team wants to ensure that no single administrator can unilaterally make changes to the domain. Which control best enforces separation of duties?

Rotate administrative passwords frequently to reduce the risk of misuse.

Use a single break-glass account that is monitored by the security team.

Give all administrators the same level of access and rely on audit logs to detect misuse.

Require two administrators to approve and perform critical changes, using a change management system that logs both approvals and actions.

A security analyst is investigating a potential privilege escalation. The logs show that a standard user account was used to create a new domain admin account. The organization has auditing enabled for account management and directory service changes. Which log entry would provide the most direct evidence of the unauthorized privilege escalation?

Event ID 4720 (user account created) followed by Event ID 4728 (member added to a security-enabled global group).

Event ID 4624 (logon) showing the standard user logged on successfully.

Event ID 4672 (special privileges assigned to new logon) for the standard user.

Event ID 4732 (member added to a security-enabled local group) on a workstation.

GIAC Defending Advanced Threats

Domain 3Objective 1

Administrative Access GDAT Practice Questions (Page 5)

Part of the Credential and Privilege Management domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 21–25

21application · medium
An organization suspects that a compromised admin account was used to create a new user and add it to the Domain Admins group. Which audit log should be reviewed first to confirm this activity?
Select an answer first
22expert · hard
A large enterprise wants to implement just-in-time administration for its 200 servers. The security team requires that every elevation be approved by a manager, time-limited, and fully audited. The operations team is concerned about delays during emergencies. Which solution best balances security and operational needs?
Select an answer first
23foundation · easy
What is a primary risk associated with domain administrator accounts?
Select an answer first
24expert · hard
An organization is reviewing its administrative access controls. The security team wants to ensure that no single administrator can unilaterally make changes to the domain. Which control best enforces separation of duties?
Select an answer first
25expert · hard
A security analyst is investigating a potential privilege escalation. The logs show that a standard user account was used to create a new domain admin account. The organization has auditing enabled for account management and directory service changes. Which log entry would provide the most direct evidence of the unauthorized privilege escalation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Administrative Access GDAT Practice Questions (Page 5)

Questions 21–25

An organization suspects that a compromised admin account was used to create a new user and add it to the Domain Admins group. Which audit log should be reviewed first to confirm this activity?

What is a primary risk associated with domain administrator accounts?

An organization is reviewing its administrative access controls. The security team wants to ensure that no single administrator can unilaterally make changes to the domain. Which control best enforces separation of duties?

Keep studying — Credential and Privilege Management