A Windows service fails to start after a password change for its service account. The service is configured to log on as a domain user. The password was changed in Active Directory, but the service still fails. What is the most likely cause?

The service account is locked out.

The service's logon credentials were not updated with the new password.

The service account lacks the 'Log on as a service' right.

A Windows service runs under a domain service account that has been granted 'Log on as a service' and is a member of the local Administrators group. The service was recently compromised. Which change best reduces the risk of lateral movement?

Remove the service account from the local Administrators group and grant only the specific permissions required.

Enable auditing on the service account.

Use a Group Managed Service Account (gMSA) instead of a standard domain user.

Change the service account password regularly.

An organization has a mix of corporate-owned and personal devices accessing Microsoft 365. They want to enforce MFA for all users, but they also want to allow personal devices to access email without full device enrollment. Which approach best balances security and user convenience?

Block all personal devices from accessing email.

Use MFA only for corporate devices.

Use Conditional Access to require MFA for all users, and use Intune app protection policies for personal devices.

Require all personal devices to be enrolled in Intune and compliant.

An organization uses Microsoft 365 and wants to prevent sensitive credit card numbers from being sent in email. They also need to ensure that any emails containing such data are blocked before delivery. Which Microsoft 365 security feature should they configure?

Microsoft Purview Data Loss Prevention (DLP) policies

Microsoft Defender for Office 365 Safe Attachments

A company allows employees to access Microsoft 365 from personal smartphones. The security team wants to ensure that only devices that are jailbroken or rooted are blocked from accessing corporate email. Which Entra ID conditional access setting should they use?

Use a conditional access policy with a device filter for 'device is jailbroken' or 'rooted'

Use Intune app protection policies without conditional access

Require device to be marked as compliant

GIAC Security Essentials

Domain 4Objective 9

Windows Services and Microsoft Cloud GSEC Practice Questions (Page 8)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

Questions 36–40

36expert · hard
A Windows service fails to start after a password change for its service account. The service is configured to log on as a domain user. The password was changed in Active Directory, but the service still fails. What is the most likely cause?
Select an answer first
37expert · hard
A Windows service runs under a domain service account that has been granted 'Log on as a service' and is a member of the local Administrators group. The service was recently compromised. Which change best reduces the risk of lateral movement?
Select an answer first
38expert · hard
An organization has a mix of corporate-owned and personal devices accessing Microsoft 365. They want to enforce MFA for all users, but they also want to allow personal devices to access email without full device enrollment. Which approach best balances security and user convenience?
Select an answer first
39application · medium
An organization uses Microsoft 365 and wants to prevent sensitive credit card numbers from being sent in email. They also need to ensure that any emails containing such data are blocked before delivery. Which Microsoft 365 security feature should they configure?
Select an answer first
40application · medium
A company allows employees to access Microsoft 365 from personal smartphones. The security team wants to ensure that only devices that are jailbroken or rooted are blocked from accessing corporate email. Which Entra ID conditional access setting should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.