A user has 'Full Control' permission on a file but is not the owner. The user wants to change the file's DACL to grant another user access. What must the user do?

The user must first take ownership of the file.

The user must have SeTakeOwnershipPrivilege.

The user can change the DACL because 'Full Control' includes 'Change Permissions'.

The user cannot change the DACL because they are not the owner.

What is the difference between a permission and a privilege in Windows?

Permissions are assigned to groups, while privileges are assigned to users only.

Permissions are system-wide, while privileges are object-specific.

Permissions are stored in the SACL, while privileges are stored in the DACL.

Permissions are granted on objects, while privileges are system-wide rights assigned to users or groups.

What information is contained in a Windows access token?

The list of audit events for the user

The encryption keys for the user's files

The user's SID, group SIDs, and privileges

A security team needs to audit failed attempts to read a sensitive file. They plan to enable auditing on the file's SACL. What must they also configure for the audit events to appear in the Security log?

Set the file's DACL to deny read for all users except the security team.

Enable the 'Audit object access' policy in Local Security Policy for both Success and Failure.

Grant the security team the SeAuditPrivilege user right.

Enable the 'Audit privilege use' policy in Local Security Policy.

An administrator wants to prevent a specific ACE from being inherited by child objects, but the ACE is currently inherited from a parent folder. What should the administrator do?

Remove the ACE from the parent folder.

Change the inheritance flags on the parent folder to 'This folder only'.

Add a deny ACE on the child object to override the inherited allow ACE.

Disable inheritance on the child object and copy the inherited ACEs.

GIAC Security Essentials

Domain 4Objective 5

Windows Access Controls GSEC Practice Questions (Page 1)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

13concepts

13 Concepts in This Objective

Windows Access Control Model
Security Identifiers (SIDs)
Access Tokens
Security Descriptors
Discretionary Access Control Lists (DACLs)
Access Control Entries (ACEs)
Access Check Algorithm
Inheritance of Permissions
Effective Permissions
Ownership and Take Ownership
Privileges and User Rights
Auditing and SACLs
Access Control Tools

Questions 1–5

1application · medium
A user has 'Full Control' permission on a file but is not the owner. The user wants to change the file's DACL to grant another user access. What must the user do?
Select an answer first
2foundation · easy
What is the difference between a permission and a privilege in Windows?
Select an answer first
3foundation · easy
What information is contained in a Windows access token?
Select an answer first
4application · medium
A security team needs to audit failed attempts to read a sensitive file. They plan to enable auditing on the file's SACL. What must they also configure for the audit events to appear in the Security log?
Select an answer first
5application · medium
An administrator wants to prevent a specific ACE from being inherited by child objects, but the ACE is currently inherited from a parent folder. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.