GSEC Windows Security Infrastructure Practice Test 1 — 15 Questions

Question 1

Refer to the exhibit. A security auditor discovers a service account running with the privileges shown. Which attack vector is most likely viable given this specific privilege set?

Accepted Answer

Offline extraction of the NTDS.dit database. The presence of SeBackupPrivilege and SeRestorePrivilege allows a user to read any file on the system, including the NTDS.dit database and SAM hives, by bypassing standard NTFS permissions. An attacker can use these privileges to copy the database to a secondary location for offline password cracking. This highlights the danger of over-privileged service accounts, which are common targets for lateral movement and privilege escalation attacks in Windows infrastructures.

Answer

Credential dumping via LSASS process injection

Answer

Remote code execution via WMI event subscriptions

Answer

Escalation to SYSTEM via Token Impersonation

Question 2

Which TWO of the following configurations are considered best practices for hardening a Windows Domain Controller against Pass-the-Hash (PtH) attacks?

Accepted Answer

Enable the 'Protected Users' security group for high-privilege accounts. Protecting Domain Controllers requires limiting the exposure of sensitive credentials in memory and restricting lateral movement. By preventing local administrators from caching credentials on high-value servers and utilizing specific security groups, you reduce the surface area available to attackers. These defenses are fundamental to modern Windows identity security, as they directly mitigate the ability of an attacker to move laterally using intercepted NTLM hashes or Kerberos tickets.

Answer

Disable NTLM authentication across the entire domain

Answer

Increase the maximum password age to 180 days

Answer

Enable 'Account is sensitive and cannot be delegated'

Question 3

Which THREE actions are recommended to secure the Active Directory (AD) database against unauthorized offline analysis?

Accepted Answer

Enable BitLocker on the volumes containing the NTDS.dit file. Securing the AD database, primarily the NTDS.dit file, is critical because it contains all domain credentials. If an attacker gains file-level access, they can extract hashes offline. Implementing physical protections, auditing file access, and utilizing virtualization-based security ensures that even if a host is compromised, the sensitive database files remain protected from extraction or unauthorized offline inspection by malicious actors.

Answer

Move the NTDS.dit file to a non-standard partition

Answer

Disable the Windows Search Indexer on the DC

Question 4

A security analyst is investigating a compromised Windows Server 2022 domain controller. The analyst suspects that an attacker used a golden ticket attack. Which Windows security event log ID should the analyst search for to find evidence of Kerberos ticket-granting ticket (TGT) usage that might indicate a forged ticket?

Accepted Answer

Event ID 4769. A golden ticket attack involves forging a Kerberos TGT, which is then used to request service tickets. These service ticket requests generate Event ID 4769. By examining 4769 events for unusual patterns, such as mismatched encryption types or service names, analysts can detect the use of a forged TGT. Other events like 4768 or 4771 are less directly indicative.

Answer

Event ID 4771

Answer

Event ID 4768

Answer

Event ID 4624

Question 5

A security team is hardening a Windows Server 2022 environment against lateral movement using Pass-the-Hash (PtH) attacks. Which TWO of the following measures are most effective in mitigating PtH? (Choose two.)

Accepted Answer

Implement the principle of least privilege by removing local administrator rights from standard users.. The most effective mitigations for Pass-the-Hash are to prevent the theft of credential material and to limit the usefulness of stolen hashes. Credential Guard isolates credentials, and least privilege ensures that even if a hash is stolen, it cannot be used for administrative access on other systems. These two measures together significantly reduce the risk of lateral movement via PtH.

Answer

Enforce a minimum password length of 14 characters for all service accounts.

Answer

Enable Protected Users security group for all domain administrators.

Answer

Disable NTLM authentication domain-wide and enforce Kerberos only.

Question 6

A security administrator is configuring a Windows 10 workstation to meet the organization's security policy. The policy requires that all local user accounts have passwords that meet complexity requirements and are changed every 60 days. Which built-in Windows tool should the administrator use to enforce these settings?

Accepted Answer

Local Security Policy. Local Security Policy is the correct tool because it provides a centralized interface for configuring account policies such as password complexity and maximum password age on a standalone Windows system. It applies directly to local user accounts, ensuring compliance with the stated security policy without requiring domain infrastructure.

Answer

Active Directory Users and Computers

Answer

Group Policy Management Console

Answer

Local Group Policy Editor

Question 7

A security engineer is reviewing the security configuration of a Windows Server 2022 environment. The engineer needs to ensure that administrative actions performed on the server are logged in a way that can be used to attribute actions to specific administrators, even if they use shared accounts. Which Windows feature should the engineer implement to achieve this requirement?

Accepted Answer

Privileged Access Management (PAM) with a bastion forest. Privileged Access Management with a bastion forest enables just-in-time privilege elevation and uses individual administrator accounts for privileged tasks. This ensures that every administrative action is tied to a specific person, providing attribution even in environments with shared accounts. Other options either lack attribution or focus on different security aspects.

Answer

Advanced Audit Policy Configuration

Answer

Just Enough Administration (JEA)

Answer

Windows Defender Credential Guard

Question 8

A security analyst is investigating a potential Golden Ticket attack on a Windows Server 2022 domain. The analyst suspects that an attacker has compromised the krbtgt account and forged a TGT. Which of the following event log entries would best indicate the use of a forged TGT?

Accepted Answer

Event ID 4768 with a Ticket Options value of 0x40810000 and a Ticket Encryption Type of 0x17, and the account has no corresponding logon event.. Golden Ticket attacks involve forging a TGT using the krbtgt account's password hash. The forged TGT often has anomalous ticket options (e.g., missing renewable flag) and uses RC4 encryption. Because the TGT is created offline, there may be no corresponding TGT issuance event (4768) on the domain controller, or the event may have different characteristics. The correct answer highlights these anomalies.

Answer

Event ID 4769 with a Service Name of krbtgt and a Ticket Encryption Type of 0x17.

Answer

Event ID 4768 with a Ticket Options value of 0x40810010 and a Ticket Encryption Type of 0x17.

Answer

Event ID 4624 with Logon Type 3 and an Account Name that does not exist in Active Directory.

Question 9

A security analyst is hardening a Windows Server 2022 domain controller. The analyst wants to implement measures to mitigate Pass-the-Hash (PtH) attacks. Which TWO of the following configurations should the analyst implement? (Choose two.)

Accepted Answer

Implement the Protected Users security group for privileged accounts. Credential Guard and the Protected Users group are both effective mitigations for Pass-the-Hash. Credential Guard isolates credential material to prevent hash extraction, while Protected Users enforces Kerberos-only authentication and blocks NTLM, reducing the attack surface. Together, they provide strong defense against PtH attacks on domain controllers.

Answer

Enable the 'Do not allow storage of passwords and credentials for network authentication' policy

Answer

Set the LAN Manager authentication level to 'Send NTLMv2 response only. Refuse LM & NTLM'

Answer

Disable NTLM authentication domain-wide

Question 10

A security administrator is configuring a Windows Server 2022 file server. The administrator needs to ensure that users can only access files based on their role, and that access is logged for auditing. Which Windows feature should the administrator use to meet these requirements?

Accepted Answer

Dynamic Access Control (DAC). Dynamic Access Control (DAC) is the correct choice because it enables granular, policy-based access control using user and device claims, which can enforce role-based access. It also supports auditing of access attempts based on these policies, providing the required logging. Other options either lack logging or are not designed for centralized role-based access.

Answer

NTFS permissions

Answer

Share permissions

Answer

Access-based Enumeration (ABE)

Question 11

An administrator needs to restrict sensitive file access on a Windows Server 2022 environment while ensuring that users only access resources based on their job titles. Which Windows technology should be implemented to leverage Dynamic Access Control (DAC) for this requirement?

Accepted Answer

Configure Central Access Policies. Dynamic Access Control allows administrators to apply access policies based on user claims and resource properties rather than traditional security groups alone. By integrating Active Directory claims and resource attributes, you can automate permissions, which significantly reduces the administrative overhead of managing thousands of individual NTFS permissions. This is critical for maintaining the principle of least privilege in scaling enterprise environments where group-based memberships become too complex to manage effectively.

Answer

Implement Kerberos Constrained Delegation

Answer

Apply AppLocker Software Restriction Policies

Answer

Utilize Encrypting File System (EFS)

Question 12

When analyzing Windows event logs to detect brute-force activity, which Event ID indicates a failed logon attempt?

Accepted Answer

Event ID 4625. Event ID 4625 is the standard Windows Security log identifier for a failed logon. Monitoring this ID is essential for identifying brute-force or credential-stuffing attacks. By correlating these logs across multiple systems, security teams can detect patterns of malicious behavior, allowing for automated account lockouts or IP blocking, which are critical components of an effective incident response strategy for Windows infrastructure.

Answer

Event ID 4624

Answer

Event ID 4740

Answer

Event ID 4768

Question 13

An organization is deploying Just-In-Time (JIT) administration. Which Windows feature provides the necessary framework for creating temporary, elevated group memberships for domain administrators?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) using Microsoft Identity Manager (MIM) allows for the creation of shadow principals in a separate forest. This approach ensures that administrative rights are only granted for a specific window of time, drastically reducing the impact of a compromised account. This is a vital architectural pattern for securing Active Directory environments against persistent threats that rely on long-lived administrative privileges to maintain access.

Answer

Restricted Groups GPO

Answer

User Rights Assignment policy

Answer

Group Policy Preferences

Question 14

When configuring an Active Directory (AD) environment, which functional level is required to utilize the 'Authentication Policies' feature introduced in Windows Server 2012?

Accepted Answer

Windows Server 2012. The Windows Server 2012 domain functional level introduced significant security improvements, including Authentication Policies and Silos. These allow for the restriction of account usage to specific hosts or services, effectively mitigating the risk of credential theft and lateral movement. Knowing these functional level requirements is critical for architects planning upgrades to ensure that modern security controls are available and correctly implemented across the forest.

Answer

Windows Server 2003

Answer

Windows Server 2008 R2

Answer

Windows Server 2016

Question 15

Which component of the Windows Security Infrastructure is responsible for checking the user's token against the Security Descriptor of an object to authorize access?

Accepted Answer

Security Reference Monitor (SRM). The Security Reference Monitor (SRM) is the core component within the Windows executive that enforces security policies. It performs the critical task of Access Check, comparing the user's security token against the object's Discretionary Access Control List (DACL). Understanding this mechanism is fundamental for any security professional, as it is the final gatekeeper for every single request to access files, registry keys, or services on a Windows system.

Answer

Local Security Authority (LSA)

Answer

Security Account Manager (SAM)

Answer

Active Directory Domain Services (AD DS)