GSEC Windows Security Infrastructure — All Questions With Answers

Question 1

Refer to the exhibit. A security auditor discovers a service account running with the privileges shown. Which attack vector is most likely viable given this specific privilege set?

Accepted Answer

Offline extraction of the NTDS.dit database. The presence of SeBackupPrivilege and SeRestorePrivilege allows a user to read any file on the system, including the NTDS.dit database and SAM hives, by bypassing standard NTFS permissions. An attacker can use these privileges to copy the database to a secondary location for offline password cracking. This highlights the danger of over-privileged service accounts, which are common targets for lateral movement and privilege escalation attacks in Windows infrastructures.

Answer

Credential dumping via LSASS process injection

Answer

Remote code execution via WMI event subscriptions

Answer

Escalation to SYSTEM via Token Impersonation

Question 2

Which TWO of the following configurations are considered best practices for hardening a Windows Domain Controller against Pass-the-Hash (PtH) attacks?

Accepted Answer

Enable the 'Protected Users' security group for high-privilege accounts. Protecting Domain Controllers requires limiting the exposure of sensitive credentials in memory and restricting lateral movement. By preventing local administrators from caching credentials on high-value servers and utilizing specific security groups, you reduce the surface area available to attackers. These defenses are fundamental to modern Windows identity security, as they directly mitigate the ability of an attacker to move laterally using intercepted NTLM hashes or Kerberos tickets.

Answer

Disable NTLM authentication across the entire domain

Answer

Increase the maximum password age to 180 days

Answer

Enable 'Account is sensitive and cannot be delegated'

Question 3

Which THREE actions are recommended to secure the Active Directory (AD) database against unauthorized offline analysis?

Accepted Answer

Enable BitLocker on the volumes containing the NTDS.dit file. Securing the AD database, primarily the NTDS.dit file, is critical because it contains all domain credentials. If an attacker gains file-level access, they can extract hashes offline. Implementing physical protections, auditing file access, and utilizing virtualization-based security ensures that even if a host is compromised, the sensitive database files remain protected from extraction or unauthorized offline inspection by malicious actors.

Answer

Move the NTDS.dit file to a non-standard partition

Answer

Disable the Windows Search Indexer on the DC

Question 4

A security analyst is investigating a compromised Windows Server 2022 domain controller. The analyst suspects that an attacker used a golden ticket attack. Which Windows security event log ID should the analyst search for to find evidence of Kerberos ticket-granting ticket (TGT) usage that might indicate a forged ticket?

Accepted Answer

Event ID 4769. A golden ticket attack involves forging a Kerberos TGT, which is then used to request service tickets. These service ticket requests generate Event ID 4769. By examining 4769 events for unusual patterns, such as mismatched encryption types or service names, analysts can detect the use of a forged TGT. Other events like 4768 or 4771 are less directly indicative.

Answer

Event ID 4771

Answer

Event ID 4768

Answer

Event ID 4624

Question 5

A security team is hardening a Windows Server 2022 environment against lateral movement using Pass-the-Hash (PtH) attacks. Which TWO of the following measures are most effective in mitigating PtH? (Choose two.)

Accepted Answer

Implement the principle of least privilege by removing local administrator rights from standard users.. The most effective mitigations for Pass-the-Hash are to prevent the theft of credential material and to limit the usefulness of stolen hashes. Credential Guard isolates credentials, and least privilege ensures that even if a hash is stolen, it cannot be used for administrative access on other systems. These two measures together significantly reduce the risk of lateral movement via PtH.

Answer

Enforce a minimum password length of 14 characters for all service accounts.

Answer

Enable Protected Users security group for all domain administrators.

Answer

Disable NTLM authentication domain-wide and enforce Kerberos only.

Question 6

A security administrator is configuring a Windows 10 workstation to meet the organization's security policy. The policy requires that all local user accounts have passwords that meet complexity requirements and are changed every 60 days. Which built-in Windows tool should the administrator use to enforce these settings?

Accepted Answer

Local Security Policy. Local Security Policy is the correct tool because it provides a centralized interface for configuring account policies such as password complexity and maximum password age on a standalone Windows system. It applies directly to local user accounts, ensuring compliance with the stated security policy without requiring domain infrastructure.

Answer

Active Directory Users and Computers

Answer

Group Policy Management Console

Answer

Local Group Policy Editor

Question 7

A security engineer is reviewing the security configuration of a Windows Server 2022 environment. The engineer needs to ensure that administrative actions performed on the server are logged in a way that can be used to attribute actions to specific administrators, even if they use shared accounts. Which Windows feature should the engineer implement to achieve this requirement?

Accepted Answer

Privileged Access Management (PAM) with a bastion forest. Privileged Access Management with a bastion forest enables just-in-time privilege elevation and uses individual administrator accounts for privileged tasks. This ensures that every administrative action is tied to a specific person, providing attribution even in environments with shared accounts. Other options either lack attribution or focus on different security aspects.

Answer

Advanced Audit Policy Configuration

Answer

Just Enough Administration (JEA)

Answer

Windows Defender Credential Guard

Question 8

A security analyst is investigating a potential Golden Ticket attack on a Windows Server 2022 domain. The analyst suspects that an attacker has compromised the krbtgt account and forged a TGT. Which of the following event log entries would best indicate the use of a forged TGT?

Accepted Answer

Event ID 4768 with a Ticket Options value of 0x40810000 and a Ticket Encryption Type of 0x17, and the account has no corresponding logon event.. Golden Ticket attacks involve forging a TGT using the krbtgt account's password hash. The forged TGT often has anomalous ticket options (e.g., missing renewable flag) and uses RC4 encryption. Because the TGT is created offline, there may be no corresponding TGT issuance event (4768) on the domain controller, or the event may have different characteristics. The correct answer highlights these anomalies.

Answer

Event ID 4769 with a Service Name of krbtgt and a Ticket Encryption Type of 0x17.

Answer

Event ID 4768 with a Ticket Options value of 0x40810010 and a Ticket Encryption Type of 0x17.

Answer

Event ID 4624 with Logon Type 3 and an Account Name that does not exist in Active Directory.

Question 9

A security analyst is hardening a Windows Server 2022 domain controller. The analyst wants to implement measures to mitigate Pass-the-Hash (PtH) attacks. Which TWO of the following configurations should the analyst implement? (Choose two.)

Accepted Answer

Implement the Protected Users security group for privileged accounts. Credential Guard and the Protected Users group are both effective mitigations for Pass-the-Hash. Credential Guard isolates credential material to prevent hash extraction, while Protected Users enforces Kerberos-only authentication and blocks NTLM, reducing the attack surface. Together, they provide strong defense against PtH attacks on domain controllers.

Answer

Enable the 'Do not allow storage of passwords and credentials for network authentication' policy

Answer

Set the LAN Manager authentication level to 'Send NTLMv2 response only. Refuse LM & NTLM'

Answer

Disable NTLM authentication domain-wide

Question 10

A security administrator is configuring a Windows Server 2022 file server. The administrator needs to ensure that users can only access files based on their role, and that access is logged for auditing. Which Windows feature should the administrator use to meet these requirements?

Accepted Answer

Dynamic Access Control (DAC). Dynamic Access Control (DAC) is the correct choice because it enables granular, policy-based access control using user and device claims, which can enforce role-based access. It also supports auditing of access attempts based on these policies, providing the required logging. Other options either lack logging or are not designed for centralized role-based access.

Answer

NTFS permissions

Answer

Share permissions

Answer

Access-based Enumeration (ABE)

Question 11

An administrator needs to restrict sensitive file access on a Windows Server 2022 environment while ensuring that users only access resources based on their job titles. Which Windows technology should be implemented to leverage Dynamic Access Control (DAC) for this requirement?

Accepted Answer

Configure Central Access Policies. Dynamic Access Control allows administrators to apply access policies based on user claims and resource properties rather than traditional security groups alone. By integrating Active Directory claims and resource attributes, you can automate permissions, which significantly reduces the administrative overhead of managing thousands of individual NTFS permissions. This is critical for maintaining the principle of least privilege in scaling enterprise environments where group-based memberships become too complex to manage effectively.

Answer

Implement Kerberos Constrained Delegation

Answer

Apply AppLocker Software Restriction Policies

Answer

Utilize Encrypting File System (EFS)

Question 12

When analyzing Windows event logs to detect brute-force activity, which Event ID indicates a failed logon attempt?

Accepted Answer

Event ID 4625. Event ID 4625 is the standard Windows Security log identifier for a failed logon. Monitoring this ID is essential for identifying brute-force or credential-stuffing attacks. By correlating these logs across multiple systems, security teams can detect patterns of malicious behavior, allowing for automated account lockouts or IP blocking, which are critical components of an effective incident response strategy for Windows infrastructure.

Answer

Event ID 4624

Answer

Event ID 4740

Answer

Event ID 4768

Question 13

An organization is deploying Just-In-Time (JIT) administration. Which Windows feature provides the necessary framework for creating temporary, elevated group memberships for domain administrators?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) using Microsoft Identity Manager (MIM) allows for the creation of shadow principals in a separate forest. This approach ensures that administrative rights are only granted for a specific window of time, drastically reducing the impact of a compromised account. This is a vital architectural pattern for securing Active Directory environments against persistent threats that rely on long-lived administrative privileges to maintain access.

Answer

Restricted Groups GPO

Answer

User Rights Assignment policy

Answer

Group Policy Preferences

Question 14

When configuring an Active Directory (AD) environment, which functional level is required to utilize the 'Authentication Policies' feature introduced in Windows Server 2012?

Accepted Answer

Windows Server 2012. The Windows Server 2012 domain functional level introduced significant security improvements, including Authentication Policies and Silos. These allow for the restriction of account usage to specific hosts or services, effectively mitigating the risk of credential theft and lateral movement. Knowing these functional level requirements is critical for architects planning upgrades to ensure that modern security controls are available and correctly implemented across the forest.

Answer

Windows Server 2003

Answer

Windows Server 2008 R2

Answer

Windows Server 2016

Question 15

Which component of the Windows Security Infrastructure is responsible for checking the user's token against the Security Descriptor of an object to authorize access?

Accepted Answer

Security Reference Monitor (SRM). The Security Reference Monitor (SRM) is the core component within the Windows executive that enforces security policies. It performs the critical task of Access Check, comparing the user's security token against the object's Discretionary Access Control List (DACL). Understanding this mechanism is fundamental for any security professional, as it is the final gatekeeper for every single request to access files, registry keys, or services on a Windows system.

Answer

Local Security Authority (LSA)

Answer

Security Account Manager (SAM)

Answer

Active Directory Domain Services (AD DS)

Question 16

A security administrator is hardening a Windows Server 2022 domain controller. They need to ensure that NTLM authentication is not used for any domain accounts and that only Kerberos is used. Which Group Policy setting should they configure?

Accepted Answer

Network security: Restrict NTLM: NTLM authentication in this domain. The 'Network security: Restrict NTLM: NTLM authentication in this domain' policy explicitly controls NTLM usage for domain accounts. Setting it to 'Deny all' blocks NTLM authentication and forces Kerberos, which is the desired outcome. Other settings may harden NTLM or Kerberos but do not disable NTLM entirely.

Answer

Network security: LAN Manager authentication level

Answer

Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

Answer

Network security: Configure encryption types allowed for Kerberos

Question 17

A security analyst is investigating a suspected credential theft attack on a Windows 10 workstation. The analyst reviews the Security event log and sees Event ID 4648 (A logon was attempted using explicit credentials) occurring repeatedly for a service account. Which of the following best describes the significance of this event in the context of credential theft?

Accepted Answer

It indicates that the service account's credentials were used to run a process with explicit credentials, which could be a sign of pass-the-hash or credential reuse.. Event ID 4648 is generated when a logon is attempted using explicit credentials, such as with RunAs or a scheduled task. In credential theft, attackers may use stolen credentials to start processes, causing this event. Repeated occurrences for a service account can signal malicious activity. Other events like 4625, 4740, or 4672 have different meanings and are not directly indicative of explicit credential use.

Answer

It indicates that the service account was granted special privileges, such as SeDebugPrivilege, which is a common post-exploitation step.

Answer

It indicates that the service account's password was changed, which is a common persistence technique after credential theft.

Answer

It indicates that the service account was locked out due to multiple failed logon attempts, which is a sign of brute-force attack.

Question 18

An organization is implementing a Windows Defender Application Control (WDAC) policy to block unauthorized executables on Windows 10 endpoints. The security team wants to ensure that only signed binaries from trusted publishers are allowed to run, but they also need to allow a specific in-house application that is not signed. What is the most appropriate approach?

Accepted Answer

Use a hash rule to allow the specific unsigned application by its file hash.. WDAC allows exceptions for specific files using hash rules. This is the most appropriate method to permit an unsigned application while still enforcing the policy for all other executables. Hash rules are precise and secure because they tie the exception to the exact file content. Disabling WDAC, using publisher rules without a signature, or switching to audit mode would either weaken security or not work.

Answer

Create a publisher rule for the in-house application's certificate, even though it is not signed.

Answer

Set WDAC to audit mode so that the unsigned application can run without being blocked.

Answer

Disable WDAC enforcement for the entire endpoint to allow the unsigned application to run.

Question 19

A security analyst is reviewing the audit policy on a Windows Server 2022 domain controller. The analyst needs to ensure that the domain controller records detailed information about changes to user account attributes, including old and new values, to support forensic investigations. Which audit policy should the analyst enable?

Accepted Answer

Audit Directory Service Changes. To capture detailed information about changes to user account attributes, including old and new values, the analyst must enable Audit Directory Service Changes. This policy logs modifications to Active Directory objects with before-and-after values, which is essential for forensic investigations. Other audit policies focus on different event types and do not provide this level of detail.

Answer

Audit User Account Management

Answer

Audit Account Logon Events

Answer

Audit Policy Change

GSEC Windows Security Infrastructure — All Questions With Answers

Refer to the exhibit. A security auditor discovers a service account running with the privileges shown. Which attack vector is most likely viable given this specific privilege set?

Exhibit

Which TWO of the following configurations are considered best practices for hardening a Windows Domain Controller against Pass-the-Hash (PtH) attacks?

Which THREE actions are recommended to secure the Active Directory (AD) database against unauthorized offline analysis?

A security team is hardening a Windows Server 2022 environment against lateral movement using Pass-the-Hash (PtH) attacks. Which TWO of the following measures are most effective in mitigating PtH? (Choose two.)

A security analyst is investigating a potential Golden Ticket attack on a Windows Server 2022 domain. The analyst suspects that an attacker has compromised the krbtgt account and forged a TGT. Which of the following event log entries would best indicate the use of a forged TGT?

A security analyst is hardening a Windows Server 2022 domain controller. The analyst wants to implement measures to mitigate Pass-the-Hash (PtH) attacks. Which TWO of the following configurations should the analyst implement? (Choose two.)

A security administrator is configuring a Windows Server 2022 file server. The administrator needs to ensure that users can only access files based on their role, and that access is logged for auditing. Which Windows feature should the administrator use to meet these requirements?

An administrator needs to restrict sensitive file access on a Windows Server 2022 environment while ensuring that users only access resources based on their job titles. Which Windows technology should be implemented to leverage Dynamic Access Control (DAC) for this requirement?

When analyzing Windows event logs to detect brute-force activity, which Event ID indicates a failed logon attempt?

An organization is deploying Just-In-Time (JIT) administration. Which Windows feature provides the necessary framework for creating temporary, elevated group memberships for domain administrators?

When configuring an Active Directory (AD) environment, which functional level is required to utilize the 'Authentication Policies' feature introduced in Windows Server 2012?

Which component of the Windows Security Infrastructure is responsible for checking the user's token against the Security Descriptor of an object to authorize access?

A security administrator is hardening a Windows Server 2022 domain controller. They need to ensure that NTLM authentication is not used for any domain accounts and that only Kerberos is used. Which Group Policy setting should they configure?

GSEC Windows Security Infrastructure — All Questions With Answers

Refer to the exhibit. A security auditor discovers a service account running with the privileges shown. Which attack vector is most likely viable given this specific privilege set?

Exhibit

Which TWO of the following configurations are considered best practices for hardening a Windows Domain Controller against Pass-the-Hash (PtH) attacks?

Which THREE actions are recommended to secure the Active Directory (AD) database against unauthorized offline analysis?

A security team is hardening a Windows Server 2022 environment against lateral movement using Pass-the-Hash (PtH) attacks. Which TWO of the following measures are most effective in mitigating PtH? (Choose two.)

A security analyst is investigating a potential Golden Ticket attack on a Windows Server 2022 domain. The analyst suspects that an attacker has compromised the krbtgt account and forged a TGT. Which of the following event log entries would best indicate the use of a forged TGT?

A security analyst is hardening a Windows Server 2022 domain controller. The analyst wants to implement measures to mitigate Pass-the-Hash (PtH) attacks. Which TWO of the following configurations should the analyst implement? (Choose two.)

A security administrator is configuring a Windows Server 2022 file server. The administrator needs to ensure that users can only access files based on their role, and that access is logged for auditing. Which Windows feature should the administrator use to meet these requirements?

An administrator needs to restrict sensitive file access on a Windows Server 2022 environment while ensuring that users only access resources based on their job titles. Which Windows technology should be implemented to leverage Dynamic Access Control (DAC) for this requirement?

When analyzing Windows event logs to detect brute-force activity, which Event ID indicates a failed logon attempt?

An organization is deploying Just-In-Time (JIT) administration. Which Windows feature provides the necessary framework for creating temporary, elevated group memberships for domain administrators?

When configuring an Active Directory (AD) environment, which functional level is required to utilize the 'Authentication Policies' feature introduced in Windows Server 2012?

Which component of the Windows Security Infrastructure is responsible for checking the user's token against the Security Descriptor of an object to authorize access?

A security administrator is hardening a Windows Server 2022 domain controller. They need to ensure that NTLM authentication is not used for any domain accounts and that only Kerberos is used. Which Group Policy setting should they configure?