Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team must detect unauthorized access to sensitive files on a file server. They have enabled 'Audit Object Access' and configured SACLs on the sensitive folders. However, the Security log is filling up quickly with thousands of successful read events, making it difficult to identify actual unauthorized access. What is the best way to reduce noise while still detecting unauthorized access?

   • ADisable object access auditing and rely on the system's built-in file access logs.
   • BIncrease the Security log size to 4 GB and let it collect all events.
   • CAudit only the 'Everyone' group for 'Read' permissions and use Event Viewer to filter for Event ID 4663.
   • DConfigure the SACL to audit only 'Write' and 'Delete' permissions for the 'Everyone' group, and use a PowerShell script to alert on failed access attempts.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Windows administrator needs to identify all user accounts that have been locked out in the past 24 hours across multiple domain controllers. The administrator wants a repeatable script that can be run daily and produce a report. Which approach best meets this requirement?

   • AUse Get-Process to find the LSASS process and read its memory for lockout data.
   • BUse Get-ADUser -Filter {Enabled -eq $false} to list disabled accounts and assume they were locked out.
   • CRun Get-WinEvent with a filter for event ID 4740 on each domain controller, then export the results to a CSV.
   • DCheck the System log on each domain controller for event ID 6005 to identify lockouts.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Windows artifact is most useful for reconstructing a user's web browsing activity?

   • AShortcut files
   • BBrowser history
   • CPrefetch files
   • DRegistry Run keys
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An investigator is reconstructing a user's activities on a Windows system. The investigator has access to the user's NTUSER.DAT hive, prefetch files, and browser history. The user is suspected of downloading a sensitive document from a web portal and then copying it to a USB drive. Which combination of artifacts would provide the strongest evidence of this sequence?

   • ABrowser history showing the download, the file's MFT record showing the file's creation time, and USBSTOR registry key showing the USB device connection.
   • BPrefetch files for the browser and the USB drive's autorun.inf.
   • CThe $LogFile and the user's browser cache.
   • DThe user's RecentDocs registry key and the file's alternate data streams.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization wants to ensure that a specific PowerShell script runs every time a user logs on to a domain-joined Windows workstation. Which method provides centralized management and enforcement?

   • AConfigure a Group Policy logon script and assign it to the appropriate Organizational Unit.
   • BPlace the script in the user's Startup folder on each workstation.
   • CCreate a scheduled task with the 'At log on' trigger on each workstation.
   • DAdd the script to the HKCU\...\Run registry key on each workstation.
   Reveal Solution Discussion Select an answer first