To audit failed read attempts on a file, what must be configured?

A deny ACE in the DACL for the read permission.

An audit ACE in the SACL with the 'fail' flag and the 'read' access mask.

A system audit policy that enables 'Audit object access' and nothing else.

An allow ACE in the DACL with the 'audit' flag.

What fields are typically found in an access control entry (ACE)?

Object type, access time, and audit flag

Which component of a Windows security descriptor defines who can access an object and what they can do with it?

System Access Control List (SACL)

Discretionary Access Control List (DACL)

An administrator needs to remove an explicit 'Deny Write' ACE from a file using a command-line tool. Which command should be used?

icacls file.txt /deny "Domain Users":W

icacls file.txt /remove:g "Domain Users"

icacls file.txt /grant "Domain Users":W

GIAC Security Essentials

Domain 4Objective 5

Windows Access Controls GSEC Practice Questions (Page 8)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

13concepts

13 Concepts in This Objective

Windows Access Control Model
Security Identifiers (SIDs)
Access Tokens
Security Descriptors
Discretionary Access Control Lists (DACLs)
Access Control Entries (ACEs)
Access Check Algorithm
Inheritance of Permissions
Effective Permissions
Ownership and Take Ownership
Privileges and User Rights
Auditing and SACLs
Access Control Tools

Questions 36–40

36foundation · easy
To audit failed read attempts on a file, what must be configured?
Select an answer first
37foundation · easy
What fields are typically found in an access control entry (ACE)?
Select an answer first
38foundation · easy
Which component of a Windows security descriptor defines who can access an object and what they can do with it?
Select an answer first
39application · medium
An administrator needs to remove an explicit 'Deny Write' ACE from a file using a command-line tool. Which command should be used?
Select an answer first
40foundation · easy
In the Windows access control model, which component acts as the subject that is evaluated against an object's security descriptor during an access check?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.