Enforcing Windows Security Policy GSEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A domain administrator needs to enforce a 10-attempt lockout policy for all users in the finance department, but the rest of the company should retain the default 5-attempt lockout. The finance users are in an OU named 'Finance'. What is the correct approach?

   • AConfigure the lockout policy in the Default Domain Policy and link it to the Finance OU.
   • BCreate a new GPO with the lockout policy and link it to the Finance OU, ensuring it has higher precedence than the Default Domain Policy.
   • CConfigure the lockout policy in the local security policy of each finance workstation.
   • DModify the Default Domain Policy to set the lockout threshold to 10, and use security filtering to apply it only to finance users.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security administrator needs to ensure that all failed logon attempts are recorded in the Security log on a Windows server. Which audit policy setting should be enabled?

   • AAudit object access - Failure
   • BAudit account logon events - Failure
   • CAudit logon events - Success
   • DAudit process tracking - Failure
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which Account Policy setting enforces a minimum number of characters for a user's password?

   • AMaximum password age
   • BMinimum password length
   • CEnforce password history
   • DAccount lockout threshold
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization has a GPO that sets 'Account lockout threshold' to 3 and 'Account lockout duration' to 15 minutes. The GPO is linked to the domain root. A user reports that their account is locked out after a single failed password attempt. The administrator verifies the GPO is applied. What is the most likely cause?

   • AA different GPO linked to the user's OU sets 'Account lockout threshold' to 1, overriding the domain-level setting.
   • BThe user's password is expired, causing the first failed attempt to trigger a lockout.
   • CThe GPO is not being applied because the user is a local administrator.
   • DThe 'Account lockout duration' of 15 minutes is too short, causing the counter to reset incorrectly.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to prevent users from seeing the last signed-in username on the Windows logon screen to reduce the risk of targeted attacks. Which Security Options setting should be configured?

   • ASet 'Interactive logon: Do not display last user name' to Enabled.
   • BSet 'Network access: Do not allow anonymous enumeration of SAM accounts' to Enabled.
   • CSet 'Interactive logon: Require Ctrl+Alt+Del' to Enabled.
   • DSet 'Interactive logon: Message text for users attempting to log on' to a warning message.
   Reveal Solution Discussion Select an answer first