What is a key benefit of using PowerShell scripts to automate forensic evidence collection on Windows systems?

They can replace the need for forensic imaging tools

They can automatically analyze memory dumps for malware

They can prevent all data from being altered during collection

They can ensure consistent and repeatable collection of evidence across multiple systems

An analyst is reviewing a Windows Security log and sees multiple event ID 4625 entries from the same source IP address within a short time. What does this pattern most likely indicate?

A brute-force attack attempting to guess passwords for user accounts.

A system reboot or startup event.

A successful logon followed by a logoff.

A user mistyping their password a few times.

An investigator is examining a Windows registry and wants to find evidence of USB devices that were connected to the system. Which registry key should be examined?

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

HKLM\SYSTEM\CurrentControlSet\Services\USBHUB

GIAC Security Essentials

Domain 4Objective 7

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 4)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 16–20

16foundation · easy
What is a key benefit of using PowerShell scripts to automate forensic evidence collection on Windows systems?
Select an answer first
17application · medium
An analyst is reviewing a Windows Security log and sees multiple event ID 4625 entries from the same source IP address within a short time. What does this pattern most likely indicate?
Select an answer first
18foundation · easy
Which tool is commonly used to analyze Windows memory dumps for malware and process information?
Select an answer first
19application · medium
An investigator is examining a Windows registry and wants to find evidence of USB devices that were connected to the system. Which registry key should be examined?
Select an answer first
20foundation · easy
Which registry hive contains information about the currently logged-on user's settings and activities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 4)

Questions 16–20

What is a key benefit of using PowerShell scripts to automate forensic evidence collection on Windows systems?

An analyst is reviewing a Windows Security log and sees multiple event ID 4625 entries from the same source IP address within a short time. What does this pattern most likely indicate?

Which tool is commonly used to analyze Windows memory dumps for malware and process information?

An investigator is examining a Windows registry and wants to find evidence of USB devices that were connected to the system. Which registry key should be examined?

Which registry hive contains information about the currently logged-on user's settings and activities?

Keep studying — Endpoint and Platform Security