GSEC Windows as a Service — 10 Questions

Question 1

A security analyst is investigating a Windows 10 Enterprise endpoint that failed to receive a critical cumulative security update within the required compliance window. Diagnostic checks reveal that the update postponement period is set to its maximum threshold. What is the maximum duration that feature updates can be deferred using Windows Update for Business policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Up to 365 days maximum deferral period. Windows Update for Business permits administrators to defer feature updates for up to 365 days to allow thorough compatibility testing before enterprise-wide deployment. Understanding these maximum thresholds is critical for security analysts auditing compliance baselines and ensuring that patching windows do not inadvertently expose systems to unpatched vulnerabilities beyond acceptable risk tolerances.

Answer

Up to 30 days maximum deferral period

Answer

Up to 90 days maximum deferral period

Answer

Up to 180 days maximum deferral period

Question 2

An IT administrator is preparing to deploy Windows 10 Enterprise feature updates using Windows Update for Business (WUfB). Which TWO actions must be taken to successfully manage and govern the update lifecycle across the domain? (Choose TWO)

Accepted Answer

Configure Group Policy settings to define specific deferral periods for feature updates and quality updates. Configuring Group Policy objects or MDM policies to manage update branches and establishing clear safeguarding thresholds are fundamental pillars of Windows as a Service governance. These measures ensure updates deploy predictably while protecting endpoints from premature installations that could break critical business workflows or introduce stability regressions.

Answer

Mandate that every workstation connects directly to a local WSUS server for WSUS-specific client agent synchronization

Answer

Disable all network telemetry and diagnostic data collection entirely via local registry modifications across all endpoints

Answer

Remove all network proxy exceptions so that Windows Update traffic is forced through an unauthenticated HTTP interceptor

Question 3

An organization has standardized on the Windows 10 Long-Term Servicing Channel (LTSC) for mission-critical manufacturing systems that cannot tolerate frequent feature changes. Which administrative reality must security teams account for regarding LTSC deployments?

Accepted Answer

LTSC editions exclude pre-installed consumer applications and the Microsoft Store to reduce attack surface. LTSC releases of Windows 10 omit many modern consumer applications and the Microsoft Store, deliberately reducing the software attack surface for specialized systems. However, security teams must remember that LTSC editions have a compressed support lifecycle compared to traditional enterprise channels, requiring careful long-term planning for eventual OS migrations.

Answer

LTSC builds receive automatic annual feature upgrades identical to the General Availability Channel

Answer

LTSC releases do not receive regular monthly quality or security updates

Answer

LTSC endpoints are managed exclusively through consumer-grade cloud settings without domain policy support

Question 4

A security architect is auditing an enterprise deployment of Windows 10 using Update Compliance in Azure. Which THREE data points or telemetry components are required to successfully populate analytics dashboards for client devices? (Choose THREE)

Accepted Answer

Commercial ID configured via policy to link client telemetry data to the correct Azure tenant workspace. Update Compliance relies on diagnostic telemetry, proper commercial ID configuration, and regular device connectivity to Microsoft cloud services to render accurate patching dashboards. Ensuring these prerequisites are met guarantees that security auditors have reliable visibility into enterprise vulnerability posture and update compliance rates.

Answer

Unrestricted local administrator rights granted to all standard users to facilitate manual cloud synchronization

Answer

Complete removal of all Active Directory domain controllers in favor of unmanaged peer-to-peer workgroups

Question 5

A security administrator manages a fleet of Windows 10 Enterprise devices that use Windows Update for Business (WUfB) with a 60-day feature update deferral. The administrator needs to ensure that devices receive only security and quality updates immediately, while feature updates are postponed for 60 days. Which Group Policy setting should the administrator configure?

Accepted Answer

Select when Feature Updates are received. The requirement is to defer feature updates for 60 days while allowing quality updates immediately. The policy 'Select when Feature Updates are received' specifically defers feature updates without impacting quality updates. Other policies either defer quality updates or are too broad. Configuring this policy with a 60-day deferral ensures feature updates are postponed, and quality updates are installed as they become available, maintaining security without disrupting feature changes.

Answer

Select when Quality Updates are received

Answer

Manage updates offered from Windows Update

Answer

Select when Preview Builds and Feature Updates are received

Question 6

A security engineer is analyzing why a Windows 10 Enterprise device did not receive a feature update that was approved for its update ring in Windows Update for Business. The device is connected to the corporate network and has no third-party update management agents. Which log should the engineer examine first to determine whether the device evaluated the feature update policy?

Accepted Answer

The Update Orchestrator log in Event Viewer under Applications and Services Logs > Microsoft > Windows > UpdateOrchestrator. The Update Orchestrator log under Applications and Services Logs > Microsoft > Windows > UpdateOrchestrator is the correct location to diagnose Windows Update for Business policy evaluation. It records when policies are received, how they are evaluated, and any errors. Other logs either are legacy, cover broader Group Policy processing, or provide cloud-based reporting rather than local policy evaluation details.

Answer

The Group Policy operational log in Event Viewer under Applications and Services Logs > Microsoft > Windows > GroupPolicy

Answer

The Windows Update for Business reports in Azure Log Analytics

Answer

The Windows Update client log at %windir%\WindowsUpdate.log

Question 7

A security analyst is reviewing the update compliance dashboard for a Windows 10 Enterprise environment. The dashboard shows that 15% of devices are missing a critical security update that was released 45 days ago. The analyst needs to determine why these devices have not received the update. Which Windows Update for Business setting is most likely responsible for the delay?

Accepted Answer

Quality update deferral set to 60 days.. The correct answer is a quality update deferral set to 60 days. This setting delays quality updates for 60 days from their release date. Since the update was released 45 days ago, it is still within the deferral window and has not been installed on the affected devices. Other settings either do not affect quality updates or would not cause a delay of this duration.

Answer

Feature update deferral set to 365 days.

Answer

Windows Update for Business ring configured with a deadline for quality updates.

Answer

Quality update deferral set to 30 days.

Question 8

A security administrator is configuring Windows Update for Business settings via Group Policy on a Windows 10 Enterprise device. The administrator wants to ensure that the device does not automatically install feature updates until 60 days after their release, but also wants to prevent the device from being forced to restart outside of active hours. Which combination of policies should the administrator configure?

Accepted Answer

Set 'Select when Feature Updates are received' to Semi-Annual Channel, deferral 60 days; and configure active hours via 'Specify active hours range for auto-restarts'.. The correct Group Policy settings are 'Select when Feature Updates are received' with a 60-day deferral and 'Specify active hours range for auto-restarts' to define when restarts are allowed. These policies directly address the need to delay feature updates and prevent restarts outside active hours. Other options either target quality updates, use Insider Preview policies, or lack a specific deferral period.

Answer

Set 'Configure Automatic Updates' to 'Auto download and notify for install'; and enable 'No auto-restart with logged on users for scheduled automatic updates installations'.

Answer

Set 'Select when Preview Builds and Feature Updates are received' to Semi-Annual Channel, deferral 60 days; and enable 'Turn off auto-restart for updates during active hours'.

Answer

Set 'Select when Quality Updates are received' to defer 60 days; and configure active hours via 'Specify active hours range for auto-restarts'.

Question 9

A security administrator is configuring Windows Update for Business policies in Microsoft Intune for a group of Windows 10 Enterprise devices. The organization wants to ensure that devices receive security updates as soon as possible but also wants to provide a grace period before forced installation. The administrator needs to configure settings that allow users to schedule restarts and avoid disruptions. Which TWO settings should the administrator configure? (Choose two.)

Accepted Answer

Configure active hours to allow users to specify when restarts can occur.. The correct settings are active hours and a deadline for quality updates. Active hours let users define when restarts can occur, providing flexibility and reducing disruptions. A deadline ensures updates are installed after a grace period, enforcing security without immediate forced restarts. Together, they balance prompt update installation with user control over restart timing.

Answer

Configure a pause for quality updates for 35 days.

Answer

Enable feature update deferral of 365 days.

Answer

Set a quality update deferral period of 0 days.

Question 10

An enterprise network administrator needs to manage Windows 10 feature updates across a heterogeneous fleet containing both Enterprise and Professional editions. Which deployment methodology natively supports setting a target release version to freeze clients on a specific version like 21H2 while blocking automatic upgrades to later versions?

Accepted Answer

Windows Update for Business configured via Group Policy to specify a target release version. Setting a target release version through Group Policy or Mobile Device Management allows administrators to freeze workstations on a specific Windows 10 feature update, such as 21H2. This control prevents automatic upgrades to newer major OS versions, ensuring mission-critical line-of-business applications remain compatible without requiring immediate manual intervention across every individual endpoint device.

Answer

Windows Server Update Services automatic approval rules targeting all newly released operating system updates

Answer

Consumer Windows Update settings modified through local registry edits on each individual workstation

Answer

Delivery Optimization peer-to-peer distribution bandwidth throttling applied via Local Group Policy