A security team is hardening new Windows 10 workstations. They want to reduce the attack surface by disabling unnecessary services and features. Which baseline configuration should they apply?

Install the latest Windows updates and enable automatic updates.

Manually disable all services that are not required for the business.

Apply the Microsoft Security Compliance Toolkit's Windows 10 security baseline.

Enable Windows Firewall and set all profiles to block inbound connections.

A user is a member of the local Administrators group on their Windows 10 workstation. When they try to run a system utility, they receive a UAC prompt. They want to avoid the prompt for this specific utility. What is the most appropriate way to do this?

Add the user to the 'Backup Operators' group.

Disable UAC for the local Administrators group by setting 'User Account Control: Admin Approval Mode for the Built-in Administrator account' to Enabled.

Set the shortcut to 'Run as administrator' and check the 'Run this program as an administrator' compatibility setting.

Use Task Scheduler to create a task that runs the utility with 'Run with highest privileges' and have the user run the task.

A security analyst needs to detect when a user attempts to access a file they are not authorized to read. The file is on an NTFS volume. What should be configured to log these attempts?

Configure a DACL on the file to deny 'Everyone' read access and enable 'Audit process creation'.

Enable 'Audit object access' in the local security policy and configure a SACL on the file to audit 'Everyone' for 'Read' failures.

Enable 'Audit logon events' in the local security policy.

Enable 'Audit privilege use' and assign the user the 'Take ownership' privilege.

Which Group Policy security setting determines how many failed logon attempts trigger a temporary account lockout?

Reset account lockout counter after

GIAC Security Essentials

Domain 4Objective 8

Windows Security Infrastructure GSEC Practice Questions (Page 2)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

12concepts

12 Concepts in This Objective

Windows Security Architecture
Authentication Mechanisms
Authorization and Access Control
Security Policies and Group Policy
User Account Control (UAC)
Windows Firewall and Network Security
Encryption and Data Protection
Patch Management and Updates
Security Auditing and Logging
Windows Defender and Endpoint Protection
Secure Configuration and Hardening
Credential Protection and Management

Questions 6–10

6foundation · easy
Which auditing policy category would you enable to log successful and failed attempts to access a specific file or folder?
Select an answer first
7application · medium
A security team is hardening new Windows 10 workstations. They want to reduce the attack surface by disabling unnecessary services and features. Which baseline configuration should they apply?
Select an answer first
8application · medium
A user is a member of the local Administrators group on their Windows 10 workstation. When they try to run a system utility, they receive a UAC prompt. They want to avoid the prompt for this specific utility. What is the most appropriate way to do this?
Select an answer first
9application · medium
A security analyst needs to detect when a user attempts to access a file they are not authorized to read. The file is on an NTFS volume. What should be configured to log these attempts?
Select an answer first
10foundation · easy
Which Group Policy security setting determines how many failed logon attempts trigger a temporary account lockout?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.