Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization has a mixed environment of Windows 10 and Windows Server 2019 systems. The security team wants to enforce a consistent audit policy across all systems and also collect the audit logs centrally. The team has limited administrative staff and wants to minimize ongoing maintenance. Which approach is most effective?

   • AEnable the 'Audit object access' policy and rely on the local Security log for each system.
   • BManually configure audit policies on each system and use a scheduled task to copy logs to a share.
   • CUse PowerShell Desired State Configuration (DSC) to enforce audit policies and have each system send logs via email.
   • DUse Group Policy to configure audit policies and Windows Event Forwarding to send security logs to a central collector.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a Windows system that is suspected of running malware. The analyst has acquired a memory dump and needs to identify malicious processes. The analyst also needs to determine if the malware communicated with a command-and-control server. Which Volatility plugin should be used first?

   • Ahashdump to extract password hashes and identify the malware's user account.
   • Bpslist to list running processes, then netscan to find network connections.
   • Ctimeliner to generate a timeline of system activity.
   • Dsvcscan to list Windows services and find malicious services.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst suspects a memory-resident malware on a Windows server. The server cannot be taken offline. Which approach best supports the investigation?

   • AUse Task Manager to list running processes and end any suspicious ones.
   • BRun netstat on the live server to identify active connections and cross-reference with running services.
   • CAcquire a memory dump using a trusted tool and analyze it with Volatility to list processes and network connections.
   • DCheck the Windows Event Log for process creation events using Event ID 4688.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   To audit when a user reads a specific confidential file, which audit policy category must be enabled in addition to configuring the file's SACL?

   • ALogon/Logoff
   • BAccount Management
   • CObject Access
   • DSystem
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An investigator needs to determine whether a user ran a specific executable on a Windows 10 system. Which Windows artifact would provide the most direct evidence of the executable being run?

   • AThe $Recycle.Bin folder, which may contain the executable if it was deleted.
   • BThe registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs.
   • CThe user's browser history, which may show downloads of the executable.
   • DThe Prefetch file for the executable, which records the last run time and run count.
   Reveal Solution Discussion Select an answer first