GSEC Windows Security Infrastructure — 10 Questions

Question 1

Refer to the exhibit. A security auditor discovers a service account running with the privileges shown. Which attack vector is most likely viable given this specific privilege set?

Accepted Answer

Offline extraction of the NTDS.dit database. The presence of SeBackupPrivilege and SeRestorePrivilege allows a user to read any file on the system, including the NTDS.dit database and SAM hives, by bypassing standard NTFS permissions. An attacker can use these privileges to copy the database to a secondary location for offline password cracking. This highlights the danger of over-privileged service accounts, which are common targets for lateral movement and privilege escalation attacks in Windows infrastructures.

Answer

Credential dumping via LSASS process injection

Answer

Remote code execution via WMI event subscriptions

Answer

Escalation to SYSTEM via Token Impersonation

Question 2

Which TWO of the following configurations are considered best practices for hardening a Windows Domain Controller against Pass-the-Hash (PtH) attacks?

Accepted Answer

Enable the 'Protected Users' security group for high-privilege accounts. Protecting Domain Controllers requires limiting the exposure of sensitive credentials in memory and restricting lateral movement. By preventing local administrators from caching credentials on high-value servers and utilizing specific security groups, you reduce the surface area available to attackers. These defenses are fundamental to modern Windows identity security, as they directly mitigate the ability of an attacker to move laterally using intercepted NTLM hashes or Kerberos tickets.

Answer

Disable NTLM authentication across the entire domain

Answer

Increase the maximum password age to 180 days

Answer

Enable 'Account is sensitive and cannot be delegated'

Question 3

Which THREE actions are recommended to secure the Active Directory (AD) database against unauthorized offline analysis?

Accepted Answer

Enable BitLocker on the volumes containing the NTDS.dit file. Securing the AD database, primarily the NTDS.dit file, is critical because it contains all domain credentials. If an attacker gains file-level access, they can extract hashes offline. Implementing physical protections, auditing file access, and utilizing virtualization-based security ensures that even if a host is compromised, the sensitive database files remain protected from extraction or unauthorized offline inspection by malicious actors.

Answer

Move the NTDS.dit file to a non-standard partition

Answer

Disable the Windows Search Indexer on the DC

Question 4

A security analyst is investigating a compromised Windows Server 2022 domain controller. The analyst suspects that an attacker used a golden ticket attack. Which Windows security event log ID should the analyst search for to find evidence of Kerberos ticket-granting ticket (TGT) usage that might indicate a forged ticket?

Accepted Answer

Event ID 4769. A golden ticket attack involves forging a Kerberos TGT, which is then used to request service tickets. These service ticket requests generate Event ID 4769. By examining 4769 events for unusual patterns, such as mismatched encryption types or service names, analysts can detect the use of a forged TGT. Other events like 4768 or 4771 are less directly indicative.

Answer

Event ID 4771

Answer

Event ID 4768

Answer

Event ID 4624

Question 5

A security team is hardening a Windows Server 2022 environment against lateral movement using Pass-the-Hash (PtH) attacks. Which TWO of the following measures are most effective in mitigating PtH? (Choose two.)

Accepted Answer

Implement the principle of least privilege by removing local administrator rights from standard users.. The most effective mitigations for Pass-the-Hash are to prevent the theft of credential material and to limit the usefulness of stolen hashes. Credential Guard isolates credentials, and least privilege ensures that even if a hash is stolen, it cannot be used for administrative access on other systems. These two measures together significantly reduce the risk of lateral movement via PtH.

Answer

Enforce a minimum password length of 14 characters for all service accounts.

Answer

Enable Protected Users security group for all domain administrators.

Answer

Disable NTLM authentication domain-wide and enforce Kerberos only.

Question 6

A security administrator is configuring a Windows 10 workstation to meet the organization's security policy. The policy requires that all local user accounts have passwords that meet complexity requirements and are changed every 60 days. Which built-in Windows tool should the administrator use to enforce these settings?

Accepted Answer

Local Security Policy. Local Security Policy is the correct tool because it provides a centralized interface for configuring account policies such as password complexity and maximum password age on a standalone Windows system. It applies directly to local user accounts, ensuring compliance with the stated security policy without requiring domain infrastructure.

Answer

Active Directory Users and Computers

Answer

Group Policy Management Console

Answer

Local Group Policy Editor

Question 7

A security engineer is reviewing the security configuration of a Windows Server 2022 environment. The engineer needs to ensure that administrative actions performed on the server are logged in a way that can be used to attribute actions to specific administrators, even if they use shared accounts. Which Windows feature should the engineer implement to achieve this requirement?

Accepted Answer

Privileged Access Management (PAM) with a bastion forest. Privileged Access Management with a bastion forest enables just-in-time privilege elevation and uses individual administrator accounts for privileged tasks. This ensures that every administrative action is tied to a specific person, providing attribution even in environments with shared accounts. Other options either lack attribution or focus on different security aspects.

Answer

Advanced Audit Policy Configuration

Answer

Just Enough Administration (JEA)

Answer

Windows Defender Credential Guard

Question 8

A security analyst is investigating a potential Golden Ticket attack on a Windows Server 2022 domain. The analyst suspects that an attacker has compromised the krbtgt account and forged a TGT. Which of the following event log entries would best indicate the use of a forged TGT?

Accepted Answer

Event ID 4768 with a Ticket Options value of 0x40810000 and a Ticket Encryption Type of 0x17, and the account has no corresponding logon event.. Golden Ticket attacks involve forging a TGT using the krbtgt account's password hash. The forged TGT often has anomalous ticket options (e.g., missing renewable flag) and uses RC4 encryption. Because the TGT is created offline, there may be no corresponding TGT issuance event (4768) on the domain controller, or the event may have different characteristics. The correct answer highlights these anomalies.

Answer

Event ID 4769 with a Service Name of krbtgt and a Ticket Encryption Type of 0x17.

Answer

Event ID 4768 with a Ticket Options value of 0x40810010 and a Ticket Encryption Type of 0x17.

Answer

Event ID 4624 with Logon Type 3 and an Account Name that does not exist in Active Directory.

Question 9

A security analyst is hardening a Windows Server 2022 domain controller. The analyst wants to implement measures to mitigate Pass-the-Hash (PtH) attacks. Which TWO of the following configurations should the analyst implement? (Choose two.)

Accepted Answer

Implement the Protected Users security group for privileged accounts. Credential Guard and the Protected Users group are both effective mitigations for Pass-the-Hash. Credential Guard isolates credential material to prevent hash extraction, while Protected Users enforces Kerberos-only authentication and blocks NTLM, reducing the attack surface. Together, they provide strong defense against PtH attacks on domain controllers.

Answer

Enable the 'Do not allow storage of passwords and credentials for network authentication' policy

Answer

Set the LAN Manager authentication level to 'Send NTLMv2 response only. Refuse LM & NTLM'

Answer

Disable NTLM authentication domain-wide

Question 10

A security administrator is configuring a Windows Server 2022 file server. The administrator needs to ensure that users can only access files based on their role, and that access is logged for auditing. Which Windows feature should the administrator use to meet these requirements?

Accepted Answer

Dynamic Access Control (DAC). Dynamic Access Control (DAC) is the correct choice because it enables granular, policy-based access control using user and device claims, which can enforce role-based access. It also supports auditing of access attempts based on these policies, providing the required logging. Other options either lack logging or are not designed for centralized role-based access.

Answer

NTFS permissions

Answer

Share permissions

Answer

Access-based Enumeration (ABE)