An organization wants to ensure that all Windows workstations have consistent security settings, such as password policy and audit policy, and that these settings are automatically applied to new computers. Which Windows automation tool should be used?

Group Policy, by linking a GPO to the appropriate organizational unit in Active Directory.

Windows Update to push security settings.

Task Scheduler to run a script that changes settings locally.

PowerShell scripts run manually on each workstation.

A forensic analyst is examining an NTFS volume and discovers a file with an alternate data stream (ADS). What does the presence of an ADS typically indicate?

The file may contain hidden data that is not visible in normal directory listings.

The file was deleted and is waiting to be overwritten.

The file is corrupted and needs to be repaired.

The file is a system file that should not be modified.

In Windows registry forensics, which key is commonly examined to determine programs that run at system startup?

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Hardware\Description\System

HKEY_CURRENT_USER\Control Panel\Desktop

A forensic examiner is analyzing an NTFS volume and needs to recover evidence of a file that was deleted several days ago. The volume has been in active use since the deletion. Which approach is most likely to recover useful evidence?

Use the $LogFile to reconstruct the file's original content.

Search the MFT for the deleted file's entry and attempt to recover its data runs, even if some clusters have been reallocated.

Look at the $Bitmap to find clusters marked as free and assume they contain the file.

Check the Recycle Bin for the file.

GIAC Security Essentials

Domain 4Objective 7

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 7)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 31–35

31application · medium
An organization wants to ensure that all Windows workstations have consistent security settings, such as password policy and audit policy, and that these settings are automatically applied to new computers. Which Windows automation tool should be used?
Select an answer first
32application · medium
A forensic analyst is examining an NTFS volume and discovers a file with an alternate data stream (ADS). What does the presence of an ADS typically indicate?
Select an answer first
33foundation · easy
In Windows registry forensics, which key is commonly examined to determine programs that run at system startup?
Select an answer first
34foundation · easy
Which Windows artifact is created when an application is launched and can be used to determine the last time the application was executed?
Select an answer first
35expert · hard
A forensic examiner is analyzing an NTFS volume and needs to recover evidence of a file that was deleted several days ago. The volume has been in active use since the deletion. Which approach is most likely to recover useful evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.