A security analyst needs to detect attempts to access a sensitive file share. The analyst wants to enable auditing that will generate events when users try to read or modify files in that share. Which audit policy configuration should be applied?

Enable 'Audit object access' and configure a SACL on the file share and its folders.

Enable 'Audit logon events' and monitor event ID 4624 for successful logons.

Enable 'Audit process creation' and monitor event ID 4688 for file access.

Enable 'Audit privilege use' and monitor event ID 4672 for special privileges.

What is the primary purpose of hashing a forensic image after acquisition?

To encrypt the image to protect it from unauthorized access

To compress the image to save storage space

To verify the integrity of the image by comparing hashes before and after acquisition

To index the image for faster searching

Which approach best combines automation and forensic tools to streamline audit reporting in a Windows environment?

Using FTK Imager to analyze event logs

Disabling audit policies to reduce log volume

Using PowerShell to collect event logs and then generating a report with a script

Manually reviewing each event log entry in Event Viewer

A security team needs to collect security event logs from 50 Windows servers every hour and generate a daily summary report. The team wants to automate this process with minimal manual effort. Which approach is most effective?

Manually open Event Viewer on each server and export the logs to a central location.

Use Windows Defender Firewall to forward security events to a central collector.

Use Group Policy to enable 'Audit logon events' on all servers and rely on the local Security log.

Create a PowerShell script that uses Get-WinEvent to query each server's Security log, then schedule it with Task Scheduler to run hourly and generate a report.

What is the primary purpose of acquiring a memory dump from a Windows system during an incident response?

To recover deleted files from the disk

To analyze file system metadata

To capture the contents of RAM, including running processes and network connections

To create a backup of the hard drive

GIAC Security Essentials

Domain 4Objective 7

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 5)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 21–25

21application · medium
A security analyst needs to detect attempts to access a sensitive file share. The analyst wants to enable auditing that will generate events when users try to read or modify files in that share. Which audit policy configuration should be applied?
Select an answer first
22foundation · easy
What is the primary purpose of hashing a forensic image after acquisition?
Select an answer first
23foundation · easy
Which approach best combines automation and forensic tools to streamline audit reporting in a Windows environment?
Select an answer first
24application · medium
A security team needs to collect security event logs from 50 Windows servers every hour and generate a daily summary report. The team wants to automate this process with minimal manual effort. Which approach is most effective?
Select an answer first
25foundation · easy
What is the primary purpose of acquiring a memory dump from a Windows system during an incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.