A security analyst needs to detect attempts to access a confidential file without authorization. The analyst wants to log both successful and failed access attempts to the file. Which auditing policy should be configured?

Audit object access with 'Success' and 'Failure' enabled, and configure a SACL on the file with 'Everyone' for 'Read'.

Enable 'Audit process creation' and monitor for the file name in command lines.

Audit logon events with 'Success' and 'Failure' enabled.

Enable 'Audit privilege use' and configure a SACL on the file for 'Write'.

GIAC Security Essentials

Domain 4Objective 8

Windows Security Infrastructure GSEC Practice Questions (Page 10)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

12concepts

12 Concepts in This Objective

Windows Security Architecture
Authentication Mechanisms
Authorization and Access Control
Security Policies and Group Policy
User Account Control (UAC)
Windows Firewall and Network Security
Encryption and Data Protection
Patch Management and Updates
Security Auditing and Logging
Windows Defender and Endpoint Protection
Secure Configuration and Hardening
Credential Protection and Management

Questions 46–46

46application · medium
A security analyst needs to detect attempts to access a confidential file without authorization. The analyst wants to log both successful and failed access attempts to the file. Which auditing policy should be configured?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Windows Security Infrastructure GSEC Practice Questions (Page 10)

Questions 46–46

A security analyst needs to detect attempts to access a confidential file without authorization. The analyst wants to log both successful and failed access attempts to the file. Which auditing policy should be configured?

Keep studying — Endpoint and Platform Security