Windows Security Infrastructure GSEC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A domain administrator is concerned about credential theft on Windows 10 workstations. They have enabled Credential Guard and added all domain admins to the Protected Users group. However, they still see NTLM authentication attempts in the security logs. What is the most likely reason?

   • ACredential Guard only protects against pass-the-hash, not NTLM usage.
   • BProtected Users group does not block NTLM for services that require it.
   • CThe domain functional level is Windows Server 2012 R2, which does not support Protected Users.
   • DThe workstations are not domain-joined.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to protect domain administrator credentials from being stolen via pass-the-hash attacks. They have a Windows Server 2019 domain with Windows 10 clients. Which measure should they implement?

   • AAdd all administrators to the Protected Users group.
   • BDisable NTLM authentication entirely in the domain.
   • CSet the 'Network security: Do not store LAN Manager hash value on next password change' policy to Enabled.
   • DEnable Credential Guard on all domain-joined Windows 10 devices.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Windows Firewall profile is applied when a computer is connected to a public network such as a coffee shop Wi-Fi?

   • ADomain profile
   • BGuest profile
   • CPrivate profile
   • DPublic profile
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which Active Directory group provides additional security protections for user accounts, such as disabling credential delegation and requiring Kerberos authentication?

   • AAccount Operators
   • BEnterprise Admins
   • CDomain Admins
   • DProtected Users
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is investigating a potential data breach. They need to determine whether a specific user accessed a confidential file on a file server. The file server has auditing enabled for object access, but the analyst cannot find any relevant events in the Security log. What is the most likely reason?

   • AThe Security log is overwritten due to low log size.
   • BThe user accessed the file from a network share, which does not generate audit events.
   • CThe SACL on the file or folder is not configured to audit successful or failed access.
   • DThe user accessed the file using an administrative share (e.g., C$).
   Reveal Solution Discussion Select an answer first