GSEC Windows Automation and Auditing — Timed 15 Questions

Question 1

An administrator needs to enforce password complexity across 500 domain-joined Windows workstations without using Group Policy Objects. Which tool is the most efficient choice for this task?

Accepted Answer

PowerShell remoting with secedit.exe. Local Security Policy settings via PowerShell's 'net accounts' or 'secedit' can be automated via scripts to enforce complexity requirements on local databases. While GPO is preferred for enterprise management, script-based automation provides a direct configuration path when the domain infrastructure is unavailable or when managing workgroup computers. This ensures consistent security posture across heterogeneous environments where centralized policy management is restricted or impossible to implement effectively.

Answer

Microsoft Endpoint Configuration Manager

Answer

Windows Admin Center

Answer

Task Scheduler with manual regedit

Question 2

A security analyst needs to quickly identify all Windows services that are configured to start automatically on a Windows 10 workstation. Which PowerShell command should be used?

Accepted Answer

Get-CimInstance Win32_Service | Where-Object {$_.StartMode -eq 'Auto'}. The correct command uses Get-CimInstance to query Win32_Service and filters on the StartMode property equal to 'Auto'. This directly returns only services configured to start automatically. The other commands either fail due to invalid parameters or do not filter, so they do not efficiently answer the scenario.

Answer

Get-Service -StartupType Automatic

Answer

Get-Service | Where-Object {$_.StartType -eq 'Auto'}

Answer

Get-WmiObject Win32_Service | Select-Object Name, StartMode

Question 3

A security consultant is reviewing the PowerShell execution policy on a Windows Server 2019 used for administrative tasks. The consultant runs `Get-ExecutionPolicy -List` and observes that the MachinePolicy scope is set to AllSigned. Which two statements accurately describe the behavior of PowerShell under this configuration? (Choose two.)

Accepted Answer

Scripts downloaded from the internet must be digitally signed by a trusted publisher to run.. The AllSigned execution policy requires all scripts and configuration files to be digitally signed by a trusted publisher. When set at the MachinePolicy scope, it cannot be overridden by local settings. Interactive commands are not restricted, and certificate expiration is validated at runtime unless timestamped. These two correct statements reflect key behaviors of AllSigned under Group Policy control.

Answer

Scripts that are part of a module must be signed, but individual functions within the module do not require separate signatures.

Answer

A script signed with a certificate that has expired will still run if the signature was valid at the time of signing.

Answer

Interactive commands typed at the PowerShell prompt are blocked unless they are part of a signed script.

Question 4

A security analyst is investigating a suspected breach on a Windows Server 2019. The analyst runs the command `wevtutil qe Security /q:"*[System[(EventID=1102)]]" /f:text` and finds no results. What does this indicate about the security log?

Accepted Answer

The security log has not been cleared since auditing was enabled.. Event ID 1102 indicates the audit log was cleared. If a query for this event returns no results, it means the event is not present in the current log. Since the log retains events until it is cleared or overwritten, the absence suggests the log has not been cleared since auditing was enabled. Other interpretations require additional assumptions not supported by the scenario.

Answer

The security log has been cleared, but the event was not recorded because auditing is disabled.

Answer

The security log has been cleared, but the event was overwritten due to log size limits.

Answer

The security log has not been cleared since the last system restart.

Question 5

A security analyst is investigating a potential compromise on a Windows Server 2019 domain controller. The analyst wants to identify all accounts that were used to perform privileged operations, such as modifying domain admin group membership, within the last 24 hours. Which Windows Security event log source and event ID should the analyst focus on?

Accepted Answer

Security log, Event ID 4728 (A member was added to a security-enabled global group). Event ID 4728 is logged when a member is added to a security-enabled global group, which includes privileged groups like Domain Admins. This event captures both the actor and the target, making it ideal for identifying accounts that performed privileged operations. Other events like 4672 or 4624 do not record group membership changes.

Answer

Security log, Event ID 4624 (An account was successfully logged on)

Answer

Security log, Event ID 4740 (A user account was locked out)

Answer

Security log, Event ID 4672 (Special privileges assigned to new logon)

Question 6

You are auditing a Windows server and need to identify which user accounts have recently utilized elevated privileges. Which specific Event ID should you prioritize in the Security log?

Accepted Answer

Event ID 4672. Event ID 4672 is generated immediately upon a successful logon when a user is assigned special privileges, such as SeDebugPrivilege or SeBackupPrivilege. Auditing this ID allows administrators to track the lifecycle of administrative access, effectively mapping privilege escalation to specific user sessions. Monitoring this is critical for detecting potential account compromise or unauthorized administrative activity within the Windows environment.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 1102

Question 7

Refer to the exhibit. What is the current configuration state for auditing 'Account Logon' events based on the provided output?

Accepted Answer

Both success and failure are being audited. The output indicates that the 'Account Logon' category is configured to audit both success and failure for credential validation. Auditing this is essential because it captures domain-wide authentication attempts occurring on the domain controller. This visibility is vital for identifying brute-force attacks or anomalous login behavior, providing a foundation for effective incident response and forensic analysis within the Windows infrastructure.

Answer

Only failure events are being audited

Answer

Auditing is completely disabled for this category

Answer

Only success events are being audited

Question 8

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

Accepted Answer

Get-LocalGroupMember -Group Administrators. Effective auditing requires querying local identity stores and task schedules. 'Get-LocalGroupMember' provides a snapshot of accounts with elevated or specific access, while 'Get-ScheduledTask' identifies persistent malicious mechanisms. Understanding these commands is critical for GSEC professionals to perform rapid host-based forensics, as these two areas are frequent targets for persistence and lateral movement by attackers.

Answer

Get-Process -IncludeUserName

Answer

Get-Service | Where-Object {$_.Status -eq 'Running'}

Answer

Get-WinEvent -LogName Security

Question 9

You are hardening a Windows environment and must restrict the use of PowerShell to only digitally signed scripts. Which command should you execute?

Accepted Answer

Set-ExecutionPolicy AllSigned. Setting the execution policy to 'AllSigned' forces the system to verify that every script has been signed by a trusted publisher. This is a fundamental security control that prevents the execution of unauthorized or tampered scripts. Implementing this policy significantly reduces the attack surface for fileless malware that relies on unconstrained execution of PowerShell commands and scripts.

Answer

Set-ExecutionPolicy RemoteSigned

Answer

Set-ExecutionPolicy Unrestricted

Answer

Set-ExecutionPolicy Bypass

Question 10

Which Windows component is responsible for the centralized management of security configurations, including password policies and user rights, across a domain?

Accepted Answer

Group Policy Objects. Group Policy Objects (GPOs) allow administrators to define specific configurations for users and computers across the entire domain. By centralizing these settings, security teams can ensure consistent enforcement of hardening standards and compliance policies. Proper GPO management is essential for minimizing the attack surface and maintaining a uniform security baseline in any enterprise Windows architecture.

Answer

Windows Registry

Answer

Task Scheduler

Answer

Microsoft Management Console

Question 11

Which THREE of the following are considered best practices for auditing Windows event logs to enhance security monitoring?

Accepted Answer

Centralize logs to a SIEM for long-term storage. Effective log auditing relies on consistency, central collection, and meaningful alerting. By setting a large log size, ensuring remote aggregation, and auditing critical security-related events, organizations move from reactive to proactive monitoring. These practices are essential for ensuring that evidence is preserved during an incident and that alerts are generated for high-value security events before they are rotated out of the local logs.

Answer

Audit every single file access on the system

Answer

Require domain admins to clear logs daily

Question 12

Which PowerShell command is used to display the current status of advanced auditing policies on a Windows system?

Accepted Answer

auditpol /get /category:*. The 'auditpol /get /category:*' command is the standard CLI method to verify the current configuration of the Advanced Audit Policy. Unlike legacy policies, advanced policies allow for granular control over what events are logged, providing better precision for security analysis. Verifying these settings is a standard step in ensuring that the security telemetry collected aligns with the organizational compliance requirements.

Answer

Get-AuditPolicy

Answer

Get-SecurityPolicy -Advanced

Answer

Get-EventLog -List

Question 13

You are a security analyst at a company that suspects an insider is exfiltrating files from a Windows Server 2019 file server. You need to enable auditing to record every time a file is read or written on a specific shared folder, while minimizing the volume of unrelated events. Which of the following should you do first?

Accepted Answer

Enable the "Audit File System" subcategory under Object Access in Advanced Audit Policy Configuration.. To audit file reads and writes on a specific folder, you must first enable the Audit File System subcategory in Advanced Audit Policy Configuration. This provides granular control and reduces noise compared to legacy basic auditing. After enabling this subcategory, you would then configure a system access control list (SACL) on the folder to specify which users and access types to audit. This combination ensures that only relevant events are logged, aligning with the principle of least privilege and efficient monitoring.

Answer

Enable the "Audit Handle Manipulation" subcategory to capture file access attempts.

Answer

Configure a basic audit policy by enabling "Audit object access" in the Local Security Policy.

Answer

Create a new Data Collector Set in Performance Monitor to track file access on the shared folder.

Question 14

A security administrator needs to ensure that all Windows 10 workstations in a domain automatically forward their security event logs to a central collector to prevent tampering and enable correlation. The organization uses Group Policy. Which of the following should the administrator configure?

Accepted Answer

Enable "Windows Event Forwarding" via the Group Policy setting "Configure target Subscription Manager" under Computer Configuration > Administrative Templates > Windows Components > Event Forwarding.. Windows Event Forwarding (WEF) is the native mechanism for collecting events from multiple computers. The Group Policy setting "Configure target Subscription Manager" tells source computers where to send events. The collector then uses subscriptions to filter and store events. This approach is scalable, secure, and supports real-time forwarding. It also allows the collector to use a dedicated service account and can be configured to use HTTPS for encryption, preventing tampering and enabling centralized analysis.

Answer

Enable the "Audit: Force audit policy subcategory settings" policy and set the Security log to archive when full.

Answer

Deploy a custom PowerShell script via Group Policy that runs at startup to copy the Security.evtx file to a network share.

Answer

Configure the "Maximum Log Size" for the Security log to a large value and enable "Overwrite events as needed".

Question 15

You are a security analyst at a financial firm. A Windows Server 2019 domain controller is suspected of unauthorized access. You need to determine which user accounts were used to log on interactively to that server during the past week. Which Windows Event ID should you examine?

Accepted Answer

Event ID 4624. Interactive logons generate Event ID 4624 with Logon Type 2. This event records the account name, logon type, and other details, making it the primary source for identifying which accounts were used for interactive access. Other events like 4634, 4648, and 4672 serve different purposes and do not directly show interactive logon activity.

Answer

Event ID 4648

Answer

Event ID 4672

Answer

Event ID 4634