If a file's DACL is empty (contains no ACEs), what is the effective access for any user?

Full control is granted to everyone.

A file has a DACL with the following ACEs in order: Allow Read for Users, Deny Write for Users, Allow Write for Administrators. A user is a member of both Users and Administrators. What is the user's effective access?

Read and Write, because the user is in Administrators and the Allow Write ACE grants Write.

Read only, because the Deny Write ACE for Users blocks Write, but the Allow Read ACE grants Read.

Write only, because the Allow Write ACE for Administrators overrides the Deny Write ACE for Users.

No access, because the Deny Write ACE blocks all access.

During an access check, how does Windows use the access token?

It stores the token in the object's SACL.

It updates the token with the object's owner.

It compares the token's SIDs and privileges against the object's DACL.

It uses the token to encrypt the object's data.

What is the purpose of the 'inherit only' flag on an ACE?

The ACE is applied only to the current object and not to children.

The ACE is ignored by the access check.

The ACE is not applied to the current object but is inherited by child objects.

The ACE is copied to all child objects and then removed from the parent.

A security team wants to audit all successful and failed attempts to read a confidential file. They have configured a SACL on the file with an audit ACE for the 'Everyone' group. However, no audit events are appearing in the Security log. What is the most likely cause?

The 'Everyone' group does not include the users attempting access.

The file's DACL denies read access to all users.

The 'Audit object access' policy is not enabled.

The SACL is not inherited by the file.

GIAC Security Essentials

Domain 4Objective 5

Windows Access Controls GSEC Practice Questions (Page 2)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

13concepts

13 Concepts in This Objective

Windows Access Control Model
Security Identifiers (SIDs)
Access Tokens
Security Descriptors
Discretionary Access Control Lists (DACLs)
Access Control Entries (ACEs)
Access Check Algorithm
Inheritance of Permissions
Effective Permissions
Ownership and Take Ownership
Privileges and User Rights
Auditing and SACLs
Access Control Tools

Questions 6–10

6foundation · easy
If a file's DACL is empty (contains no ACEs), what is the effective access for any user?
Select an answer first
7application · medium
A file has a DACL with the following ACEs in order: Allow Read for Users, Deny Write for Users, Allow Write for Administrators. A user is a member of both Users and Administrators. What is the user's effective access?
Select an answer first
8foundation · easy
During an access check, how does Windows use the access token?
Select an answer first
9foundation · easy
What is the purpose of the 'inherit only' flag on an ACE?
Select an answer first
10expert · medium
A security team wants to audit all successful and failed attempts to read a confidential file. They have configured a SACL on the file with an audit ACE for the 'Everyone' group. However, no audit events are appearing in the Security log. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.