GSEC Windows Automation and Auditing — 10 Questions

Question 1

An administrator needs to enforce password complexity across 500 domain-joined Windows workstations without using Group Policy Objects. Which tool is the most efficient choice for this task?

Accepted Answer

PowerShell remoting with secedit.exe. Local Security Policy settings via PowerShell's 'net accounts' or 'secedit' can be automated via scripts to enforce complexity requirements on local databases. While GPO is preferred for enterprise management, script-based automation provides a direct configuration path when the domain infrastructure is unavailable or when managing workgroup computers. This ensures consistent security posture across heterogeneous environments where centralized policy management is restricted or impossible to implement effectively.

Answer

Microsoft Endpoint Configuration Manager

Answer

Windows Admin Center

Answer

Task Scheduler with manual regedit

Question 2

A security analyst needs to quickly identify all Windows services that are configured to start automatically on a Windows 10 workstation. Which PowerShell command should be used?

Accepted Answer

Get-CimInstance Win32_Service | Where-Object {$_.StartMode -eq 'Auto'}. The correct command uses Get-CimInstance to query Win32_Service and filters on the StartMode property equal to 'Auto'. This directly returns only services configured to start automatically. The other commands either fail due to invalid parameters or do not filter, so they do not efficiently answer the scenario.

Answer

Get-Service -StartupType Automatic

Answer

Get-Service | Where-Object {$_.StartType -eq 'Auto'}

Answer

Get-WmiObject Win32_Service | Select-Object Name, StartMode

Question 3

A security consultant is reviewing the PowerShell execution policy on a Windows Server 2019 used for administrative tasks. The consultant runs `Get-ExecutionPolicy -List` and observes that the MachinePolicy scope is set to AllSigned. Which two statements accurately describe the behavior of PowerShell under this configuration? (Choose two.)

Accepted Answer

Scripts downloaded from the internet must be digitally signed by a trusted publisher to run.. The AllSigned execution policy requires all scripts and configuration files to be digitally signed by a trusted publisher. When set at the MachinePolicy scope, it cannot be overridden by local settings. Interactive commands are not restricted, and certificate expiration is validated at runtime unless timestamped. These two correct statements reflect key behaviors of AllSigned under Group Policy control.

Answer

Scripts that are part of a module must be signed, but individual functions within the module do not require separate signatures.

Answer

A script signed with a certificate that has expired will still run if the signature was valid at the time of signing.

Answer

Interactive commands typed at the PowerShell prompt are blocked unless they are part of a signed script.

Question 4

A security analyst is investigating a suspected breach on a Windows Server 2019. The analyst runs the command `wevtutil qe Security /q:"*[System[(EventID=1102)]]" /f:text` and finds no results. What does this indicate about the security log?

Accepted Answer

The security log has not been cleared since auditing was enabled.. Event ID 1102 indicates the audit log was cleared. If a query for this event returns no results, it means the event is not present in the current log. Since the log retains events until it is cleared or overwritten, the absence suggests the log has not been cleared since auditing was enabled. Other interpretations require additional assumptions not supported by the scenario.

Answer

The security log has been cleared, but the event was not recorded because auditing is disabled.

Answer

The security log has been cleared, but the event was overwritten due to log size limits.

Answer

The security log has not been cleared since the last system restart.

Question 5

A security analyst is investigating a potential compromise on a Windows Server 2019 domain controller. The analyst wants to identify all accounts that were used to perform privileged operations, such as modifying domain admin group membership, within the last 24 hours. Which Windows Security event log source and event ID should the analyst focus on?

Accepted Answer

Security log, Event ID 4728 (A member was added to a security-enabled global group). Event ID 4728 is logged when a member is added to a security-enabled global group, which includes privileged groups like Domain Admins. This event captures both the actor and the target, making it ideal for identifying accounts that performed privileged operations. Other events like 4672 or 4624 do not record group membership changes.

Answer

Security log, Event ID 4624 (An account was successfully logged on)

Answer

Security log, Event ID 4740 (A user account was locked out)

Answer

Security log, Event ID 4672 (Special privileges assigned to new logon)

Question 6

You are auditing a Windows server and need to identify which user accounts have recently utilized elevated privileges. Which specific Event ID should you prioritize in the Security log?

Accepted Answer

Event ID 4672. Event ID 4672 is generated immediately upon a successful logon when a user is assigned special privileges, such as SeDebugPrivilege or SeBackupPrivilege. Auditing this ID allows administrators to track the lifecycle of administrative access, effectively mapping privilege escalation to specific user sessions. Monitoring this is critical for detecting potential account compromise or unauthorized administrative activity within the Windows environment.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 1102

Question 7

Refer to the exhibit. What is the current configuration state for auditing 'Account Logon' events based on the provided output?

Accepted Answer

Both success and failure are being audited. The output indicates that the 'Account Logon' category is configured to audit both success and failure for credential validation. Auditing this is essential because it captures domain-wide authentication attempts occurring on the domain controller. This visibility is vital for identifying brute-force attacks or anomalous login behavior, providing a foundation for effective incident response and forensic analysis within the Windows infrastructure.

Answer

Only failure events are being audited

Answer

Auditing is completely disabled for this category

Answer

Only success events are being audited

Question 8

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

Accepted Answer

Get-LocalGroupMember -Group Administrators. Effective auditing requires querying local identity stores and task schedules. 'Get-LocalGroupMember' provides a snapshot of accounts with elevated or specific access, while 'Get-ScheduledTask' identifies persistent malicious mechanisms. Understanding these commands is critical for GSEC professionals to perform rapid host-based forensics, as these two areas are frequent targets for persistence and lateral movement by attackers.

Answer

Get-Process -IncludeUserName

Answer

Get-Service | Where-Object {$_.Status -eq 'Running'}

Answer

Get-WinEvent -LogName Security

Question 9

You are hardening a Windows environment and must restrict the use of PowerShell to only digitally signed scripts. Which command should you execute?

Accepted Answer

Set-ExecutionPolicy AllSigned. Setting the execution policy to 'AllSigned' forces the system to verify that every script has been signed by a trusted publisher. This is a fundamental security control that prevents the execution of unauthorized or tampered scripts. Implementing this policy significantly reduces the attack surface for fileless malware that relies on unconstrained execution of PowerShell commands and scripts.

Answer

Set-ExecutionPolicy RemoteSigned

Answer

Set-ExecutionPolicy Unrestricted

Answer

Set-ExecutionPolicy Bypass

Question 10

Which Windows component is responsible for the centralized management of security configurations, including password policies and user rights, across a domain?

Accepted Answer

Group Policy Objects. Group Policy Objects (GPOs) allow administrators to define specific configurations for users and computers across the entire domain. By centralizing these settings, security teams can ensure consistent enforcement of hardening standards and compliance policies. Proper GPO management is essential for minimizing the attack surface and maintaining a uniform security baseline in any enterprise Windows architecture.

Answer

Windows Registry

Answer

Task Scheduler

Answer

Microsoft Management Console