A company has an on-premises Active Directory domain and uses Microsoft 365. They want to enable single sign-on (SSO) so users can access both on-premises applications and Microsoft 365 with the same credentials. Which Entra ID feature should they implement?

Microsoft Entra Connect sync with password hash synchronization

Microsoft Entra ID Protection risk policies

Microsoft Entra ID B2B collaboration

Microsoft Entra ID Governance access reviews

A company uses Microsoft 365 and wants to require multi-factor authentication (MFA) for all users but allow exceptions for a small group of service accounts that cannot use MFA. Which Entra ID feature should they use to implement this?

Per-user MFA settings, enabling MFA for each user individually.

Entra ID Identity Protection with user risk policies.

Conditional Access policies with a policy that requires MFA for all users, excluding the service accounts.

Security defaults, which enforce MFA for all users and cannot be customized.

A Windows service runs under a domain service account. The account is a member of the Domain Admins group. The service only needs to read a specific network share. What is the most appropriate action to reduce the security risk?

Keep the account in Domain Admins but restrict the share permissions.

Disable the service because it is a security risk.

Create a new dedicated domain service account with only read access to the required share, and update the service to use it.

Change the service to run under LocalSystem to avoid domain account management.

An organization uses Microsoft Entra ID (Azure AD) for cloud identity. They want to require multi-factor authentication (MFA) for all users accessing Microsoft 365 from untrusted networks, but not from the corporate office. Which Entra ID feature should they configure?

Azure AD Identity Protection user risk policy

Conditional Access policy with a location condition

Self-service password reset (SSPR) with MFA registration

Privileged Identity Management (PIM) activation

GIAC Security Essentials

Domain 4Objective 9

Windows Services and Microsoft Cloud GSEC Practice Questions (Page 5)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

Questions 21–25

21application · medium
A company has an on-premises Active Directory domain and uses Microsoft 365. They want to enable single sign-on (SSO) so users can access both on-premises applications and Microsoft 365 with the same credentials. Which Entra ID feature should they implement?
Select an answer first
22application · medium
A company uses Microsoft 365 and wants to require multi-factor authentication (MFA) for all users but allow exceptions for a small group of service accounts that cannot use MFA. Which Entra ID feature should they use to implement this?
Select an answer first
23application · medium
A Windows service runs under a domain service account. The account is a member of the Domain Admins group. The service only needs to read a specific network share. What is the most appropriate action to reduce the security risk?
Select an answer first
24application · medium
An organization uses Microsoft Entra ID (Azure AD) for cloud identity. They want to require multi-factor authentication (MFA) for all users accessing Microsoft 365 from untrusted networks, but not from the corporate office. Which Entra ID feature should they configure?
Select an answer first
25foundation · easy
Which Microsoft cloud service is used to manage and secure endpoints such as Windows PCs, mobile devices, and servers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.