GIAC Security Essentials
Domain 4Objective 7
Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 2)
Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)
50questions here
10free pages
10concepts
Questions 6–10
- 6
In PowerShell, which cmdlet would you use to change the value of a registry key?
Select an answer first - 7
Which Windows automation tool is primarily used to execute administrative tasks based on time-based triggers or system events?
Select an answer first - 8
Which PowerShell cmdlet is used to retrieve a list of all running services on a Windows system?
Select an answer first - 9
A forensic examiner is analyzing an NTFS volume and needs to recover a deleted file that has not been overwritten. Which NTFS artifact should the examiner inspect first?
Select an answer first - 10
In Windows Event Viewer, which log contains events related to user logon and logoff activities?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.