GSEC Windows Automation and Auditing — All Questions With Answers

Question 1

An administrator needs to enforce password complexity across 500 domain-joined Windows workstations without using Group Policy Objects. Which tool is the most efficient choice for this task?

Accepted Answer

PowerShell remoting with secedit.exe. Local Security Policy settings via PowerShell's 'net accounts' or 'secedit' can be automated via scripts to enforce complexity requirements on local databases. While GPO is preferred for enterprise management, script-based automation provides a direct configuration path when the domain infrastructure is unavailable or when managing workgroup computers. This ensures consistent security posture across heterogeneous environments where centralized policy management is restricted or impossible to implement effectively.

Answer

Microsoft Endpoint Configuration Manager

Answer

Windows Admin Center

Answer

Task Scheduler with manual regedit

Question 2

A security analyst needs to quickly identify all Windows services that are configured to start automatically on a Windows 10 workstation. Which PowerShell command should be used?

Accepted Answer

Get-CimInstance Win32_Service | Where-Object {$_.StartMode -eq 'Auto'}. The correct command uses Get-CimInstance to query Win32_Service and filters on the StartMode property equal to 'Auto'. This directly returns only services configured to start automatically. The other commands either fail due to invalid parameters or do not filter, so they do not efficiently answer the scenario.

Answer

Get-Service -StartupType Automatic

Answer

Get-Service | Where-Object {$_.StartType -eq 'Auto'}

Answer

Get-WmiObject Win32_Service | Select-Object Name, StartMode

Question 3

A security consultant is reviewing the PowerShell execution policy on a Windows Server 2019 used for administrative tasks. The consultant runs `Get-ExecutionPolicy -List` and observes that the MachinePolicy scope is set to AllSigned. Which two statements accurately describe the behavior of PowerShell under this configuration? (Choose two.)

Accepted Answer

Scripts downloaded from the internet must be digitally signed by a trusted publisher to run.. The AllSigned execution policy requires all scripts and configuration files to be digitally signed by a trusted publisher. When set at the MachinePolicy scope, it cannot be overridden by local settings. Interactive commands are not restricted, and certificate expiration is validated at runtime unless timestamped. These two correct statements reflect key behaviors of AllSigned under Group Policy control.

Answer

Scripts that are part of a module must be signed, but individual functions within the module do not require separate signatures.

Answer

A script signed with a certificate that has expired will still run if the signature was valid at the time of signing.

Answer

Interactive commands typed at the PowerShell prompt are blocked unless they are part of a signed script.

Question 4

A security analyst is investigating a suspected breach on a Windows Server 2019. The analyst runs the command `wevtutil qe Security /q:"*[System[(EventID=1102)]]" /f:text` and finds no results. What does this indicate about the security log?

Accepted Answer

The security log has not been cleared since auditing was enabled.. Event ID 1102 indicates the audit log was cleared. If a query for this event returns no results, it means the event is not present in the current log. Since the log retains events until it is cleared or overwritten, the absence suggests the log has not been cleared since auditing was enabled. Other interpretations require additional assumptions not supported by the scenario.

Answer

The security log has been cleared, but the event was not recorded because auditing is disabled.

Answer

The security log has been cleared, but the event was overwritten due to log size limits.

Answer

The security log has not been cleared since the last system restart.

Question 5

A security analyst is investigating a potential compromise on a Windows Server 2019 domain controller. The analyst wants to identify all accounts that were used to perform privileged operations, such as modifying domain admin group membership, within the last 24 hours. Which Windows Security event log source and event ID should the analyst focus on?

Accepted Answer

Security log, Event ID 4728 (A member was added to a security-enabled global group). Event ID 4728 is logged when a member is added to a security-enabled global group, which includes privileged groups like Domain Admins. This event captures both the actor and the target, making it ideal for identifying accounts that performed privileged operations. Other events like 4672 or 4624 do not record group membership changes.

Answer

Security log, Event ID 4624 (An account was successfully logged on)

Answer

Security log, Event ID 4740 (A user account was locked out)

Answer

Security log, Event ID 4672 (Special privileges assigned to new logon)

Question 6

You are auditing a Windows server and need to identify which user accounts have recently utilized elevated privileges. Which specific Event ID should you prioritize in the Security log?

Accepted Answer

Event ID 4672. Event ID 4672 is generated immediately upon a successful logon when a user is assigned special privileges, such as SeDebugPrivilege or SeBackupPrivilege. Auditing this ID allows administrators to track the lifecycle of administrative access, effectively mapping privilege escalation to specific user sessions. Monitoring this is critical for detecting potential account compromise or unauthorized administrative activity within the Windows environment.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 1102

Question 7

Refer to the exhibit. What is the current configuration state for auditing 'Account Logon' events based on the provided output?

Accepted Answer

Both success and failure are being audited. The output indicates that the 'Account Logon' category is configured to audit both success and failure for credential validation. Auditing this is essential because it captures domain-wide authentication attempts occurring on the domain controller. This visibility is vital for identifying brute-force attacks or anomalous login behavior, providing a foundation for effective incident response and forensic analysis within the Windows infrastructure.

Answer

Only failure events are being audited

Answer

Auditing is completely disabled for this category

Answer

Only success events are being audited

Question 8

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

Accepted Answer

Get-LocalGroupMember -Group Administrators. Effective auditing requires querying local identity stores and task schedules. 'Get-LocalGroupMember' provides a snapshot of accounts with elevated or specific access, while 'Get-ScheduledTask' identifies persistent malicious mechanisms. Understanding these commands is critical for GSEC professionals to perform rapid host-based forensics, as these two areas are frequent targets for persistence and lateral movement by attackers.

Answer

Get-Process -IncludeUserName

Answer

Get-Service | Where-Object {$_.Status -eq 'Running'}

Answer

Get-WinEvent -LogName Security

Question 9

You are hardening a Windows environment and must restrict the use of PowerShell to only digitally signed scripts. Which command should you execute?

Accepted Answer

Set-ExecutionPolicy AllSigned. Setting the execution policy to 'AllSigned' forces the system to verify that every script has been signed by a trusted publisher. This is a fundamental security control that prevents the execution of unauthorized or tampered scripts. Implementing this policy significantly reduces the attack surface for fileless malware that relies on unconstrained execution of PowerShell commands and scripts.

Answer

Set-ExecutionPolicy RemoteSigned

Answer

Set-ExecutionPolicy Unrestricted

Answer

Set-ExecutionPolicy Bypass

Question 10

Which Windows component is responsible for the centralized management of security configurations, including password policies and user rights, across a domain?

Accepted Answer

Group Policy Objects. Group Policy Objects (GPOs) allow administrators to define specific configurations for users and computers across the entire domain. By centralizing these settings, security teams can ensure consistent enforcement of hardening standards and compliance policies. Proper GPO management is essential for minimizing the attack surface and maintaining a uniform security baseline in any enterprise Windows architecture.

Answer

Windows Registry

Answer

Task Scheduler

Answer

Microsoft Management Console

Question 11

Which THREE of the following are considered best practices for auditing Windows event logs to enhance security monitoring?

Accepted Answer

Centralize logs to a SIEM for long-term storage. Effective log auditing relies on consistency, central collection, and meaningful alerting. By setting a large log size, ensuring remote aggregation, and auditing critical security-related events, organizations move from reactive to proactive monitoring. These practices are essential for ensuring that evidence is preserved during an incident and that alerts are generated for high-value security events before they are rotated out of the local logs.

Answer

Audit every single file access on the system

Answer

Require domain admins to clear logs daily

Question 12

Which PowerShell command is used to display the current status of advanced auditing policies on a Windows system?

Accepted Answer

auditpol /get /category:*. The 'auditpol /get /category:*' command is the standard CLI method to verify the current configuration of the Advanced Audit Policy. Unlike legacy policies, advanced policies allow for granular control over what events are logged, providing better precision for security analysis. Verifying these settings is a standard step in ensuring that the security telemetry collected aligns with the organizational compliance requirements.

Answer

Get-AuditPolicy

Answer

Get-SecurityPolicy -Advanced

Answer

Get-EventLog -List

Question 13

You are a security analyst at a company that suspects an insider is exfiltrating files from a Windows Server 2019 file server. You need to enable auditing to record every time a file is read or written on a specific shared folder, while minimizing the volume of unrelated events. Which of the following should you do first?

Accepted Answer

Enable the "Audit File System" subcategory under Object Access in Advanced Audit Policy Configuration.. To audit file reads and writes on a specific folder, you must first enable the Audit File System subcategory in Advanced Audit Policy Configuration. This provides granular control and reduces noise compared to legacy basic auditing. After enabling this subcategory, you would then configure a system access control list (SACL) on the folder to specify which users and access types to audit. This combination ensures that only relevant events are logged, aligning with the principle of least privilege and efficient monitoring.

Answer

Enable the "Audit Handle Manipulation" subcategory to capture file access attempts.

Answer

Configure a basic audit policy by enabling "Audit object access" in the Local Security Policy.

Answer

Create a new Data Collector Set in Performance Monitor to track file access on the shared folder.

Question 14

A security administrator needs to ensure that all Windows 10 workstations in a domain automatically forward their security event logs to a central collector to prevent tampering and enable correlation. The organization uses Group Policy. Which of the following should the administrator configure?

Accepted Answer

Enable "Windows Event Forwarding" via the Group Policy setting "Configure target Subscription Manager" under Computer Configuration > Administrative Templates > Windows Components > Event Forwarding.. Windows Event Forwarding (WEF) is the native mechanism for collecting events from multiple computers. The Group Policy setting "Configure target Subscription Manager" tells source computers where to send events. The collector then uses subscriptions to filter and store events. This approach is scalable, secure, and supports real-time forwarding. It also allows the collector to use a dedicated service account and can be configured to use HTTPS for encryption, preventing tampering and enabling centralized analysis.

Answer

Enable the "Audit: Force audit policy subcategory settings" policy and set the Security log to archive when full.

Answer

Deploy a custom PowerShell script via Group Policy that runs at startup to copy the Security.evtx file to a network share.

Answer

Configure the "Maximum Log Size" for the Security log to a large value and enable "Overwrite events as needed".

Question 15

You are a security analyst at a financial firm. A Windows Server 2019 domain controller is suspected of unauthorized access. You need to determine which user accounts were used to log on interactively to that server during the past week. Which Windows Event ID should you examine?

Accepted Answer

Event ID 4624. Interactive logons generate Event ID 4624 with Logon Type 2. This event records the account name, logon type, and other details, making it the primary source for identifying which accounts were used for interactive access. Other events like 4634, 4648, and 4672 serve different purposes and do not directly show interactive logon activity.

Answer

Event ID 4648

Answer

Event ID 4672

Answer

Event ID 4634

Question 16

You are a security administrator for a Windows environment. You need to audit changes to critical files on a file server to detect unauthorized modifications. You decide to use Windows auditing features. Which TWO of the following steps must you perform to enable and capture file modification events? (Choose two.)

Accepted Answer

Configure a System Access Control List (SACL) on the files to be monitored.. To audit file modifications, you must first enable the 'Audit object access' policy, which allows the system to log access attempts. Then, you must set a SACL on each file or folder to specify what to audit. Only with both steps will Event ID 4663 (an attempt was made to access an object) be logged for modifications. The other options do not enable file auditing.

Answer

Set up a Windows Management Instrumentation (WMI) event subscription to monitor file changes.

Answer

Enable the 'Audit process tracking' policy.

Answer

Configure a Discretionary Access Control List (DACL) to deny write access to all users.

Question 17

A security analyst at a financial firm suspects that an attacker used a service account to create a new local administrator on a Windows 10 workstation. The analyst runs `auditpol /get /category:*` and sees that the 'Account Management' subcategory is set to 'No Auditing'. Which action should the analyst take to capture future events of this type while minimizing noise?

Accepted Answer

Enable the 'Account Management' subcategory with both Success and Failure auditing.. The Account Management subcategory is specifically designed to log changes to user accounts and groups, including creation, deletion, and membership modifications. Enabling both Success and Failure auditing ensures that any attempt to add a local administrator is recorded, whether it succeeds or fails. This directly targets the suspicious activity while avoiding the overhead of unrelated audit categories.

Answer

Enable the 'Policy Change' subcategory with Success auditing only.

Answer

Enable the 'Detailed Tracking' subcategory with Success auditing only.

Answer

Enable the 'Logon/Logoff' subcategory with Failure auditing only.

Question 18

You are a security consultant reviewing a Windows Server 2016 environment. The client wants to ensure that all administrative actions are logged and can be traced back to individual administrators. Currently, all administrators use a shared domain admin account. Which security control should you recommend to meet this requirement?

Accepted Answer

Implement separate administrative accounts for each administrator.. The core issue is that shared accounts prevent attribution. To trace administrative actions to individuals, each administrator must have a unique account. This ensures that audit logs record the specific user who performed each action. Other options address audit policy settings but do not solve the fundamental problem of shared credentials.

Answer

Configure a Group Policy Object to enable 'Audit process tracking' for all servers.

Answer

Enable the 'Audit: Force audit policy subcategory settings' policy.

Answer

Enable 'Audit: Shut down system immediately if unable to log security audits'.

Question 19

A junior administrator needs to quickly identify all Windows services that are currently set to start automatically but are not running on a Windows Server 2016. Which PowerShell command should the administrator use?

Accepted Answer

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -ne 'Running'}. To find automatic services that are not running, you must filter by StartType equal to 'Automatic' and Status not equal to 'Running'. The correct command uses Where-Object with -and and -ne to capture all non-running states. This ensures you don't miss services that are paused or in transition.

Answer

Get-Service -StartType Automatic | Where-Object {$_.Status -eq 'Stopped'}

Answer

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -or $_.Status -eq 'Stopped'}

Answer

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -eq 'Stopped'}

Question 20

A security administrator wants to enable PowerShell script block logging on a Windows 10 workstation to capture suspicious script content. The administrator runs `Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'`. Which registry value should be configured to enable this feature?

Accepted Answer

EnableScriptBlockLogging (DWORD) set to 1. Script block logging is enabled by setting the EnableScriptBlockLogging DWORD value to 1 under the ScriptBlockLogging registry key. This logs script blocks to Event ID 4104, providing visibility into potentially malicious scripts. Other logging features like module logging and transcription serve different purposes and are configured elsewhere.

Answer

EnableTranscripting (DWORD) set to 1

Answer

EnableScriptBlockInvocationLogging (DWORD) set to 1

Answer

EnableModuleLogging (DWORD) set to 1

GSEC Windows Automation and Auditing — All Questions With Answers

An administrator needs to enforce password complexity across 500 domain-joined Windows workstations without using Group Policy Objects. Which tool is the most efficient choice for this task?

A security analyst needs to quickly identify all Windows services that are configured to start automatically on a Windows 10 workstation. Which PowerShell command should be used?

A security analyst is investigating a suspected breach on a Windows Server 2019. The analyst runs the command `wevtutil qe Security /q:"*[System[(EventID=1102)]]" /f:text` and finds no results. What does this indicate about the security log?

You are auditing a Windows server and need to identify which user accounts have recently utilized elevated privileges. Which specific Event ID should you prioritize in the Security log?

Refer to the exhibit. What is the current configuration state for auditing 'Account Logon' events based on the provided output?

Exhibit

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

You are hardening a Windows environment and must restrict the use of PowerShell to only digitally signed scripts. Which command should you execute?

Which Windows component is responsible for the centralized management of security configurations, including password policies and user rights, across a domain?

Which THREE of the following are considered best practices for auditing Windows event logs to enhance security monitoring?

Which PowerShell command is used to display the current status of advanced auditing policies on a Windows system?

A security administrator needs to ensure that all Windows 10 workstations in a domain automatically forward their security event logs to a central collector to prevent tampering and enable correlation. The organization uses Group Policy. Which of the following should the administrator configure?

You are a security analyst at a financial firm. A Windows Server 2019 domain controller is suspected of unauthorized access. You need to determine which user accounts were used to log on interactively to that server during the past week. Which Windows Event ID should you examine?

A junior administrator needs to quickly identify all Windows services that are currently set to start automatically but are not running on a Windows Server 2016. Which PowerShell command should the administrator use?

GSEC Windows Automation and Auditing — All Questions With Answers

An administrator needs to enforce password complexity across 500 domain-joined Windows workstations without using Group Policy Objects. Which tool is the most efficient choice for this task?

A security analyst needs to quickly identify all Windows services that are configured to start automatically on a Windows 10 workstation. Which PowerShell command should be used?

A security analyst is investigating a suspected breach on a Windows Server 2019. The analyst runs the command `wevtutil qe Security /q:"*[System[(EventID=1102)]]" /f:text` and finds no results. What does this indicate about the security log?

You are auditing a Windows server and need to identify which user accounts have recently utilized elevated privileges. Which specific Event ID should you prioritize in the Security log?

Refer to the exhibit. What is the current configuration state for auditing 'Account Logon' events based on the provided output?

Exhibit

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

You are hardening a Windows environment and must restrict the use of PowerShell to only digitally signed scripts. Which command should you execute?

Which Windows component is responsible for the centralized management of security configurations, including password policies and user rights, across a domain?

Which THREE of the following are considered best practices for auditing Windows event logs to enhance security monitoring?

Which PowerShell command is used to display the current status of advanced auditing policies on a Windows system?

A security administrator needs to ensure that all Windows 10 workstations in a domain automatically forward their security event logs to a central collector to prevent tampering and enable correlation. The organization uses Group Policy. Which of the following should the administrator configure?

You are a security analyst at a financial firm. A Windows Server 2019 domain controller is suspected of unauthorized access. You need to determine which user accounts were used to log on interactively to that server during the past week. Which Windows Event ID should you examine?

A junior administrator needs to quickly identify all Windows services that are currently set to start automatically but are not running on a Windows Server 2016. Which PowerShell command should the administrator use?