GSEC Windows Access Controls Practice Test 1 — 15 Questions

Question 1

An administrator needs to configure a local Windows security policy so that standard users cannot install unauthorized software, even if they have local administrator rights on non-domain joined workstations. Which User Account Control (UAC) policy setting enforces administrator approval for all applications requiring elevation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User Account Control: Run all administrators in Admin Approval Mode. Enforcing Administrator Approval Mode via UAC ensures that all administrative operations prompt for explicit consent or credentials, mitigating unauthorized software installations. This security control is vital for preventing malware execution and maintaining the integrity of enterprise endpoints against insider and external threats alike.

Answer

User Account Control: Detect application installations and prompt for elevation

Answer

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

Answer

User Account Control: Only elevate executables that are signed and validated

Question 2

A file server has 'Everyone: Read' NTFS permissions and 'Administrators: Full Control' Share permissions. A domain user tries to access a file over the network. What is the result?

Accepted Answer

The user is denied access.. In Windows, the most restrictive permission applies when combining Share and NTFS levels. While the NTFS permissions allow Read access for Everyone, the Share permissions do not explicitly grant Read access to domain users. Consequently, the user is denied access. This highlights the importance of configuring both layers correctly to avoid accidental lockout, as the security model requires a 'Yes' from both distinct permission sets for successful access.

Answer

The user is granted Read access.

Answer

The user is granted Full Control access.

Answer

The user is granted Write access.

Question 3

When configuring Windows Access Control Lists (ACLs), which TWO of the following statements correctly describe the behavior of 'Explicit' versus 'Inherited' permissions?

Accepted Answer

Explicit permissions override inherited permissions.. Understanding the difference between explicit and inherited permissions is vital for auditing access. Explicit permissions are defined directly on an object, while inherited permissions flow from parent containers. When an object is moved or renamed, its inheritance status determines whether it retains old permissions or adopts new ones from the destination folder. Professionals must grasp this to identify potential security leaks caused by inheritance misconfigurations during file migration tasks.

Answer

Explicit permissions are listed as 'Inherited' in the GUI.

Answer

Inherited permissions automatically disappear after 30 days.

Answer

Inherited permissions cannot be viewed in the GUI.

Question 4

You are auditing a server and find that a user has 'Full Control' on a file despite not being in the explicit access list. What is the most likely reason?

Accepted Answer

The user is the owner of the file.. In Windows, ownership grants a user the 'Take Ownership' right, which implicitly allows them to change permissions and grant themselves full control. If a user creates a file, they become the owner and can bypass existing ACLs. Understanding ownership is crucial for auditors because it represents a common blind spot where users can escalate their own privileges regardless of the existing restrictive access control lists defined by administrators.

Answer

The user is a member of the 'Everyone' group.

Answer

The user has bypassed Group Policy.

Answer

The file is encrypted with EFS.

Question 5

Which THREE of the following are true regarding the behavior of 'Deny' permissions in Windows Access Control Lists?

Accepted Answer

Deny entries are processed before Allow entries.. Deny permissions are a powerful tool in Windows security, but they must be used carefully. Because Deny entries are processed before Allow entries, they act as an absolute override. This makes them useful for blocking specific accounts from sensitive data, but improper usage can lead to unintended access issues. Understanding these rules is a core requirement for GSEC professionals tasked with designing robust and predictable access control policies.

Answer

Deny permissions can be overridden by explicit Allow entries.

Answer

Deny entries are best practice for general access management.

Answer

Deny permissions only apply to local users.

Question 6

A Windows file server hosts a shared folder named Projects on an NTFS volume. The Share permissions for Projects are set to Everyone: Change. The NTFS permissions on the folder grant the domain group Project_Managers Modify and the domain group Project_Staff Read & Execute. A user, Maria, is a member of both Project_Managers and Project_Staff. She attempts to delete a file within the Projects folder but receives an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The NTFS permissions on the file itself do not grant Delete to Maria, and the folder's Modify permission does not automatically propagate to files for deletion.. Effective permissions are the intersection of Share and NTFS permissions. Share allows Change, so NTFS is the limiting factor. The folder grants Modify to Project_Managers, which normally includes Delete Subfolders and Files. However, if the file has explicit permissions that do not include Delete and inheritance is disabled, the user cannot delete it. Thus, the most likely cause is that the file's NTFS permissions lack Delete for Maria, and the folder's Modify does not apply to the file due to broken inheritance.

Answer

The NTFS permissions for Project_Staff include a Deny Delete subfolder permission that takes precedence over her Modify permission from Project_Managers.

Answer

The Share permissions are limiting her to Change, which does not include delete.

Answer

The file is marked with the Read-only attribute, which prevents deletion even with Modify NTFS permissions.

Question 7

A security administrator is configuring a Windows Server 2022 file share. The share permissions are set to 'Everyone: Read'. The NTFS permissions on the folder are set to 'SalesGroup: Modify'. A user named Bob is a member of SalesGroup. He attempts to save a new file to the share. What will happen?

Accepted Answer

Bob will be unable to save the file because the share permission for Everyone is Read, which does not allow writing.. When both share and NTFS permissions are present, the effective permission is the most restrictive combination. The share permission of Read for Everyone prevents any write operation, regardless of NTFS permissions. Therefore, Bob cannot save the file despite having Modify NTFS permissions through his group membership.

Answer

Bob will be unable to save the file because the Everyone group does not have Modify share permissions.

Answer

Bob will be able to save the file because he is a member of SalesGroup, which has Modify NTFS permissions.

Answer

Bob will be able to save the file because NTFS permissions take precedence over share permissions.

Question 8

A security analyst is examining a Windows 10 workstation and notices that a user account named 'BackupSvc' has the 'Back up files and directories' user right assigned. The analyst wants to understand the implications of this right. Which statement accurately describes a capability granted by this user right?

Accepted Answer

The account can bypass NTFS permissions to back up files, but it cannot back up files if those files are encrypted with EFS unless it has the appropriate EFS recovery keys.. The 'Back up files and directories' user right grants the ability to bypass NTFS permissions to read files for backup purposes. However, it does not bypass EFS encryption; to back up EFS-encrypted files, the account must have access to the encryption keys or be an EFS recovery agent. Therefore, the correct statement is that the account can bypass NTFS permissions but faces limitations with EFS-encrypted files.

Answer

The account can restore files and directories, and it can also take ownership of files and other objects if the 'Restore files and directories' right is assigned.

Answer

The account can read any file on the system, regardless of NTFS permissions, by using the Backup Operators group membership.

Answer

The account can modify the permissions of any file it backs up, because the backup right includes the WRITE_DAC permission.

Question 9

A security analyst is examining the access control settings on a Windows Server 2019 file server. The analyst observes that a folder has inheritance enabled, and a user named Carol has Full Control permissions on the folder. Carol is also a member of a group that has 'Deny' for 'Write' on a subfolder. Which two statements correctly describe the effective permissions for Carol on the subfolder? (Choose two.)

Accepted Answer

Carol will be denied write access to the subfolder because the Deny permission for the group takes precedence over her inherited Full Control.. Windows evaluates explicit Deny ACEs before Allow ACEs, and group Deny applies to members. Carol's group has an explicit Deny for Write on the subfolder, which overrides her inherited Full Control from the parent folder. The Deny does not remove inherited permissions but effectively blocks write access. Group membership is included in the access check, so the Deny applies to Carol.

Answer

The Deny permission only applies if Carol accesses the subfolder over the network, not locally.

Answer

Carol will still have write access because her user account has Full Control, which is an explicit Allow that overrides group Deny.

Answer

Carol's Full Control permission will be removed from the subfolder because inheritance is enabled and the Deny permission breaks inheritance.

Question 10

A security analyst is reviewing access on a Windows Server 2022 file server. A folder named C:\Finance has an explicit ACE granting the user Alice Modify permission. Alice is also a member of the group Finance_Readers, which has an explicit Deny Write ACE on the same folder. Alice attempts to write a file to C:\Finance. What is the result and why?

Accepted Answer

Alice cannot write the file because the explicit Deny Write ACE for Finance_Readers is evaluated first and overrides her Allow Modify ACE.. The correct answer is the one stating that Alice cannot write because the explicit Deny Write ACE for Finance_Readers is evaluated first. Windows access control evaluation processes explicit Deny ACEs before Allow ACEs, and a Deny that applies to the user through group membership overrides an explicit Allow on the user. Therefore, Alice's write attempt is denied.

Answer

Alice can write the file because Deny ACEs on groups are ignored when the user has an explicit Allow.

Answer

Alice cannot write the file because NTFS permissions are cumulative and the most restrictive permission wins, which is Deny Write from the group.

Answer

Alice can write the file because her explicit Allow Modify ACE takes precedence over the group Deny.

Question 11

A system administrator notices that a user account has 'Read' permissions to a folder but is unable to access the files within it. Which Windows security mechanism is most likely restricting the user's access despite the NTFS permission settings?

Accepted Answer

Share Permissions. Effective access in Windows is the intersection of NTFS permissions and Share permissions. If an account is denied access at the Share level, it will override any Read permissions granted via NTFS. Understanding this dual-layer architecture is critical for troubleshooting access issues, as security professionals must verify both file system attributes and network-level sharing configurations to ensure that policies are applied correctly and consistently across the environment.

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Answer

Group Policy Object (GPO) Inheritance

Question 12

Refer to the exhibit. What is the effect of the (OI)(CI) flags on the 'Finance_Users' group for the C:\Data directory?

Accepted Answer

Files and subfolders inherit the permissions from the parent.. The (OI) flag stands for Object Inherit, and (CI) stands for Container Inherit. These flags ensure that permissions assigned to the parent folder propagate to all files and subfolders within the directory. This is essential for maintaining consistent access control in environments with deep directory structures. Without these flags, newly created files or subfolders might not inherit the necessary security descriptors, leading to potential access gaps or security policy bypasses.

Answer

Only existing files are modified.

Answer

The permissions are applied to C:\Data only, not children.

Answer

The user cannot delete the folder.

Question 13

Which Windows feature allows for fine-grained access control based on user attributes like department or project code rather than just security groups?

Accepted Answer

Dynamic Access Control (DAC). Dynamic Access Control (DAC) allows administrators to create policies based on resource and user properties, providing a more flexible and scalable alternative to traditional security groups. This is essential in large organizations where maintaining thousands of security groups becomes unmanageable. DAC enhances the GSEC focus on least privilege by enabling context-aware access decisions that adapt automatically as user attributes change within Active Directory or file metadata.

Answer

Access-Based Enumeration (ABE)

Answer

NTFS Permissions

Answer

User Account Control (UAC)

Question 14

A security analyst is reviewing file server permissions and notices that a user, Elena, has the 'Modify' permission on a folder via group membership in 'Project_X', but she is also a member of the 'Contractors' group, which has an explicit 'Deny' for 'Write'. Elena reports she cannot edit any files in the folder. What is the most likely explanation for this behavior?

Accepted Answer

The 'Deny' permission for the 'Contractors' group takes precedence over the 'Allow' permission inherited from 'Project_X'.. Windows access control evaluates Deny entries before Allow entries. An explicit Deny for a group applies to all its members, and it overrides any Allow permissions, even those granted through other group memberships or inheritance. Thus, Elena's Write access is blocked by the Deny on the Contractors group, despite her Modify permission from Project_X.

Answer

The 'Deny' permission only applies if Elena is directly listed, not via group membership.

Answer

The 'Write' permission is not included in the 'Modify' permission, so the Deny for Write does not affect Modify.

Answer

The 'Modify' permission from 'Project_X' is inherited and therefore is overridden by the explicit 'Deny'.

Question 15

A security administrator is troubleshooting access issues on a Windows file server. A user, Bob, is a member of the 'Sales' group, which has 'Read & Execute' on a folder. Bob is also a member of the 'Managers' group, which has 'Full Control' on the same folder. However, Bob cannot delete files. What is the most likely cause?

Accepted Answer

The 'Sales' group has an explicit 'Deny' for 'Delete' that overrides the 'Full Control' from 'Managers'.. In Windows ACLs, an explicit Deny entry overrides any Allow permissions, regardless of the source. If the Sales group has a Deny for Delete, Bob's membership in that group triggers the Deny, preventing deletion even though Managers grants Full Control. This is the most plausible explanation given the information.

Answer

The 'Full Control' permission from 'Managers' does not include the 'Delete' permission.

Answer

Bob's user account has an explicit 'Deny' for 'Delete' that is inherited from the parent folder.

Answer

The 'Read & Execute' permission from 'Sales' is more restrictive and overrides the 'Full Control' from 'Managers'.