Windows Security Infrastructure GSEC Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A user reports that they can open a confidential file in the finance share but cannot modify it, even though their manager can. Both users are in the same AD group that has Modify permission on the folder. You check the file's security descriptor and find that the file's DACL grants the group Modify, but the file also has an explicit Deny Write ACE for the user. What is the most likely reason the user cannot modify the file?

   • AThe user's access token does not include the group SID because of UAC filtering.
   • BThe file is encrypted with EFS and the user lacks the private key.
   • CThe Deny ACE overrides the group's Allow ACE because Deny entries are evaluated first.
   • DThe security reference monitor is caching the old permissions from before the group was added.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which Windows encryption technology provides full-volume encryption for the system drive and requires a Trusted Platform Module (TPM) for the most secure configuration?

   • ASMB Encryption
   • BBitLocker
   • CEFS
   • DDPAPI
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has a server that stores sensitive data. They want to encrypt the data at rest and also ensure that if the server is stolen, the data cannot be accessed by removing the disks. They also want to be able to recover the data if the server's motherboard fails. Which solution should they implement?

   • ABitLocker with TPM-only protector
   • BBitLocker with TPM + recovery key stored in Active Directory
   • CEFS with a data recovery agent
   • DBitLocker with TPM + PIN protector
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security analyst is investigating a suspicious process that attempted to access a protected file. The analyst needs to determine whether the process had the necessary permissions and which security identifier (SID) was used for the access check. Which Windows component should the analyst examine?

   • AThe audit policy for object access.
   • BThe Windows event log for process creation.
   • CThe security descriptor of the file.
   • DThe access token of the process.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A laptop is used by a sales representative who travels frequently. The laptop contains sensitive customer data. The company requires that if the laptop is stolen, the data cannot be read by an attacker, even if the attacker removes the hard drive and connects it to another computer. Which technology should be used?

   • ADPAPI
   • BBitLocker Drive Encryption
   • CEncrypting File System (EFS)
   • DWindows Defender Application Guard
   Reveal Solution Discussion Select an answer first