Windows Services and Microsoft Cloud GSEC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   Your organization has a Windows service that periodically downloads updates from an external vendor API. The service currently runs as LocalSystem. You are asked to reduce the risk of compromise. Which change best aligns with least privilege while maintaining functionality?

   • ASwitch the service to run as NetworkService and grant the machine account outbound HTTPS access.
   • BCreate a local user account with a strong password, grant Log on as a service, and assign it only the 'Read' permission to the download folder.
   • CCreate a domain user account with a strong password, grant Log on as a service, and restrict its access to only the vendor API and the local download folder.
   • DKeep LocalSystem but apply a restrictive software firewall policy to block all outbound traffic except to the vendor API.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary security concern when a Windows service runs under the Local System account?

   • AIt has no network access
   • BIt cannot interact with the desktop
   • CIt has excessive privileges on the local system
   • DIts password is difficult to manage
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company allows employees to use personal devices to access Microsoft 365. They want to ensure that corporate data is protected even if the device is lost or stolen. Which approach provides the best protection without requiring full device management?

   • AUse Microsoft Intune app protection policies (MAM) to control data access and remote wipe of corporate data.
   • BUse Microsoft Defender for Endpoint on personal devices.
   • CRequire device enrollment in Intune and enforce full device compliance.
   • DUse conditional access to block access from personal devices entirely.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A Windows service fails to start with error 1069: 'The service did not start due to a logon failure.' The service is configured to run as a domain user account. What is the most likely cause and the appropriate fix?

   • AThe service account is locked out due to multiple failed attempts; unlock the account in Active Directory.
   • BThe service is set to 'Automatic (Delayed Start)' and the system is still booting; wait for the delay to expire.
   • CThe service account lacks the 'Log on as a service' right; grant that right in Local Security Policy.
   • DThe service account's password has expired; reset the password and update it in the service configuration.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A multinational company uses Microsoft 365 and must comply with data residency requirements that mandate personal data of EU users remain stored in the EU. They also want to allow EU users to collaborate with users in other regions. Which approach should they take?

   • ACreate a separate EU tenant for EU users and do not allow any collaboration with other regions.
   • BUse Entra ID conditional access to block access from outside the EU.
   • CUse a single global Microsoft 365 tenant located in the US and rely on data loss prevention policies.
   • DUse Microsoft 365 Multi-Geo to store EU users' data in an EU datacenter while allowing collaboration across regions.
   Reveal Solution Discussion Select an answer first