An analyst is investigating a Windows system and needs to determine which programs ran when a specific user logged on. Which registry hive and key should the analyst examine?

HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_USERS\ \Software\Microsoft\Windows\CurrentVersion\Run

A security team needs to automate the collection of forensic evidence from Windows endpoints after a security incident. The team wants to minimize the impact on the endpoints and ensure the evidence is collected consistently. Which approach best balances these requirements?

Deploy a PowerShell script via Group Policy that collects specified event logs, registry keys, and file system artifacts, and saves them to a network share.

Use a commercial EDR tool that continuously collects and stores endpoint telemetry in the cloud.

Enable Windows Error Reporting to send crash dumps to a central server.

Manually run FTK Imager on each endpoint after an incident.

An investigator needs to determine which USB devices were connected to a Windows system. Which registry hive and key should be examined?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

An analyst is reconstructing user activity on a Windows 10 workstation. Which combination of artifacts provides the most reliable evidence of a user launching a specific application?

Prefetch files and UserAssist registry keys

Shortcut files and the Recycle Bin

Windows Event Logs and the $LogFile

Browser history and cookie files

GIAC Security Essentials

Domain 4Objective 7

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 10)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 46–50

46application · medium
An analyst is investigating a Windows system and needs to determine which programs ran when a specific user logged on. Which registry hive and key should the analyst examine?
Select an answer first
47foundation · easy
Which of the following is a common tool used to create forensic images of Windows storage media?
Select an answer first
48expert · hard
A security team needs to automate the collection of forensic evidence from Windows endpoints after a security incident. The team wants to minimize the impact on the endpoints and ensure the evidence is collected consistently. Which approach best balances these requirements?
Select an answer first
49application · medium
An investigator needs to determine which USB devices were connected to a Windows system. Which registry hive and key should be examined?
Select an answer first
50application · medium
An analyst is reconstructing user activity on a Windows 10 workstation. Which combination of artifacts provides the most reliable evidence of a user launching a specific application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.