Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security administrator needs to track when users attempt to access a specific folder on a file server. The administrator has enabled 'Audit object access' in the audit policy. What additional step is required to generate the desired audit events?

   • ARestart the Windows Event Log service to activate auditing.
   • BInstall a third-party file monitoring tool.
   • CConfigure a System Access Control List (SACL) on the folder to specify which access attempts to audit.
   • DEnable 'Audit logon events' in the audit policy.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic examiner has created a forensic image of a suspect drive. Which step is essential to verify that the image is an exact copy of the original?

   • AMount the image and browse the files to ensure they open correctly.
   • BCheck the image file size against the drive's advertised capacity.
   • CCompute a hash of the original drive and the image and compare them.
   • DRun chkdsk on the original drive to confirm it is error-free.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A Windows administrator needs to automate the collection of specific event logs from multiple servers and generate a daily summary report. The solution must be reliable and not require manual intervention. Which approach is most appropriate?

   • AConfigure each server to email its event logs directly to the administrator.
   • BCreate a PowerShell script that queries each server's event log, exports the results to a CSV, and schedule it with Task Scheduler to run daily.
   • CUse Group Policy to enable event log forwarding to a central collector and then manually review the logs.
   • DWrite a batch file that uses wevtutil to export logs and run it manually each morning.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic team needs to acquire images from 50 Windows workstations involved in a security incident. The team has limited time and must ensure the images are forensically sound. Which approach best balances speed and integrity?

   • AHave each user copy their documents folder to a shared drive.
   • BRun FTK Imager on each workstation remotely via PowerShell and save images to a central server.
   • CUse Windows Backup to create system images on each workstation and then copy them to a central location.
   • DDeploy a trusted bootable forensic image to each workstation via PXE and use a script to acquire the disk to a network share, computing hashes automatically.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is investigating a Windows system and wants to determine if a specific user accessed a particular document file. Which Windows artifact would provide the most direct evidence?

   • AThe system's Prefetch files
   • BThe Windows Event Log Security log
   • CThe user's RecentDocs registry key
   • DThe user's browser history
   Reveal Solution Discussion Select an answer first