GSEC Windows Services and MS Cloud — All Questions With Answers

Question 1

A system administrator needs to ensure that a critical Windows service runs with the least privilege necessary while still maintaining access to a local database. Which account type provides a unique SID, limited network privileges, and a virtual account profile?

Accepted Answer

Virtual Account. Virtual Accounts were introduced in Windows 7/Server 2008 R2 to mitigate risks associated with over-privileged service accounts. They possess a unique SID, automatically manage passwords, and are restricted to the local machine, making them ideal for applications requiring database access without domain-wide network exposure. Utilizing these accounts significantly hardens the service environment by preventing lateral movement if the service process is compromised by an attacker.

Answer

LocalSystem account

Answer

NetworkService account

Answer

LocalService account

Question 2

An administrator observes that the policy in the exhibit is failing to provide access to an authorized user working from a corporate VPN. The user's external IP is 203.0.113.5. What is the root cause of this access failure?

Accepted Answer

The SourceIp condition does not match the requester IP.. The IAM policy explicitly restricts access to the specified S3 bucket to requests originating from the 192.168.1.0/24 subnet. Since the user is connecting from 203.0.113.5, which is outside the defined CIDR block, the condition is not met. Understanding how IP-based conditions function is critical for security auditing, as overly restrictive IP policies often cause legitimate operational failures while failing to protect against sophisticated bypass techniques like VPNs or proxies.

Answer

The Resource ARN is malformed.

Answer

The Action list is missing 's3:ListBucket'.

Answer

The Effect is set to 'Allow' instead of 'Deny'.

Question 3

Which TWO of the following actions are best practice when securing Azure AD (Entra ID) service principals used for automated CI/CD pipelines?

Accepted Answer

Use Managed Identities whenever possible to avoid secret management.. Securing service principals involves minimizing the attack surface by applying the principle of least privilege and utilizing non-persistent authentication methods. Using managed identities or short-lived certificates instead of long-lived secrets significantly lowers the risk of credential leakage. Regularly auditing these identities ensures that only necessary permissions remain active, preventing long-term exposure during an incident. These practices are essential for protecting cloud resources against unauthorized access or privilege escalation.

Answer

Assign the Global Administrator role for maximum visibility.

Answer

Rotate client secrets every 30 days.

Answer

Enable password writeback for the service principal.

Question 4

Which THREE of the following are critical hardening steps for an Azure App Service hosting a sensitive public-facing web application?

Accepted Answer

Configure Access Restrictions using IP allowlists.. Hardening a public-facing App Service requires a layered defense. Restricting network access ensures that only legitimate traffic reaches the application. Implementing managed identities removes the need for stored credentials. Finally, enabling diagnostic logging is essential for incident response, providing the visibility needed to detect and investigate potential attacks against the application. Combining these steps provides a robust security posture against common web vulnerabilities and unauthorized access attempts in cloud environments.

Answer

Disable Managed Identity and use a Service Principal.

Answer

Enable the 'Always On' feature for higher performance.

Question 5

A security analyst is reviewing a Windows Server 2022 event log and sees repeated Event ID 4625 (An account failed to log on) with Logon Type 4. The account name is a domain service account used by a custom backup service. Which of the following is the MOST likely explanation for these failed logon attempts?

Accepted Answer

The backup service is configured to log on as the service account, but the account lacks the 'Log on as a service' right on the server.. The repeated Event ID 4625 with Logon Type 4 points to a batch logon failure, which is characteristic of a service or scheduled task. When a service account lacks the 'Log on as a service' right, the Service Control Manager cannot perform the batch logon, resulting in these events. The other options either produce different logon types or different error patterns.

Answer

An attacker is performing a brute-force attack against the service account from a remote workstation.

Answer

A scheduled task is running under the service account and is failing due to an expired password.

Answer

The service account password has been changed recently and the service has not been restarted to pick up the new credentials.

Question 6

An administrator is auditing a Windows Server 2019 file server and notices that a scheduled task is configured to run under the built-in SYSTEM account. The task executes a PowerShell script that writes to a network share on a different server. The script fails with an access denied error when attempting to write to the share. The administrator confirms that the share permissions and NTFS permissions allow the computer account of the file server to write. What is the most likely reason for the failure?

Accepted Answer

The SYSTEM account is a local account and cannot be used for network authentication; therefore, the script must be configured to run under a domain user account that has permissions on the remote share.. The SYSTEM account is a local account that authenticates to network resources using the computer account credentials. While the computer account may have permissions on the share, there are scenarios where the computer account is not recognized or lacks the necessary rights, such as when the remote server is in a different domain or when the share permissions are not correctly configured for computer accounts. Running the task under a domain user account with explicit permissions ensures reliable network access. The other options misidentify the root cause or suggest irrelevant fixes.

Answer

The scheduled task is running under the SYSTEM account, which does not have a user profile and therefore cannot access mapped network drives or UNC paths that require user credentials.

Answer

The SYSTEM account on the file server does not have network access because it authenticates as the computer account, but the share is on a different server and the computer account lacks the necessary permissions.

Answer

The scheduled task is failing because the SYSTEM account does not have the 'Log on as a batch job' right, which is required for scheduled tasks to run and access network resources.

Question 7

A security administrator is investigating a potential compromise of a Windows Server that runs a custom service. The service is configured to log on as a domain user account, and the administrator suspects the account's credentials were dumped from memory. Which Windows security event ID should the administrator search for to detect attempts to access the Local Security Authority Subsystem Service (LSASS) process?

Accepted Answer

Event ID 4656. To detect attempts to access the LSASS process, security administrators should monitor for Event ID 4656, which indicates a handle to an object was requested. When an attacker tries to dump credentials, they request a handle to the LSASS process, generating this event if auditing is properly configured. Event ID 4624 is for logons, 4663 is for object access, and 4688 is for process creation; none of these directly capture the handle request to LSASS. Therefore, 4656 is the correct event ID to search for.

Answer

Event ID 4624

Answer

Event ID 4663

Answer

Event ID 4688

Question 8

A security engineer is reviewing a Windows Server 2022 domain controller's security log and notices Event ID 4625 (An account failed to log on) with Logon Type 3 and the process name 'lsass.exe'. The source workstation is a member server that hosts a service configured to run under a domain user account. The engineer suspects the service is failing because the account's password has expired. Which of the following is the most likely cause of the failed logons?

Accepted Answer

The service account's password has expired, and the service is using a cached credential that has not been updated.. The failed network logons with lsass.exe as the process indicate a service using a domain account. If the account's password expires and the service configuration is not updated, the service will continue to use the old password, causing authentication failures. This is a common issue when password expiration policies apply to service accounts without proper management.

Answer

The service account is not a member of the 'Log on as a service' right, preventing it from starting.

Answer

The service account is locked out due to multiple failed logon attempts.

Answer

The service account's password has exceeded the maximum age defined in the domain's fine-grained password policy.

Question 9

You are auditing a Windows Server environment and identify that a service is configured to log on as a 'Group Managed Service Account' (gMSA). What is the primary security advantage of using this account type over a standard domain user account?

Accepted Answer

They automatically rotate passwords without service restarts.. gMSAs provide automatic password management, where the Windows OS handles password rotation without manual intervention or service downtime. This significantly reduces the risk of password compromise or credential theft via brute-force or persistent local storage. By removing the need for human administrators to manage long-lived static credentials, gMSAs enforce a robust security posture that adheres to modern standards for service identity lifecycle management and long-term protection against credential-based lateral movement.

Answer

They enable Kerberos constrained delegation by default.

Answer

They bypass the need for an SPN registration.

Answer

They allow for local interactive logons on all domain controllers.

Question 10

An administrator wants to prevent unauthorized modification of Windows Services. Which tool allows for the centralized management of service startup types and logon accounts across multiple domain-joined systems?

Accepted Answer

Group Policy Management Console (GPMC). Group Policy Objects (GPO) are the standard mechanism in Windows environments to enforce security configurations, including service management, across an entire fleet. Centralized control ensures that security policies are applied consistently, preventing configuration drift and unauthorized changes that could be exploited by attackers. By leveraging GPOs, administrators can maintain a hardened baseline, which is a foundational requirement for both GIAC compliance standards and general enterprise cybersecurity best practices.

Answer

Task Scheduler

Answer

Services.msc

Answer

Local Security Policy (secpol.msc)

Question 11

When auditing an Azure environment, you notice that a Virtual Machine is utilizing a User-Assigned Managed Identity. How does this differ from a System-Assigned Managed Identity?

Accepted Answer

User-assigned identities exist as separate, independent Azure resources.. System-assigned identities are tied directly to the lifecycle of the Azure resource (e.g., the VM is deleted, the identity is deleted). User-assigned identities exist as independent resources in Azure, allowing them to be shared across multiple resources and managed independently. This flexibility is crucial for complex architectures where multiple services need to share access permissions without creating redundant identity objects, simplifying long-term identity lifecycle management and improving security granularity.

Answer

User-assigned identities do not require Entra ID authentication.

Answer

System-assigned identities can be shared across multiple resources.

Answer

System-assigned identities provide more granular permission scopes.

Question 12

You are troubleshooting a service startup failure on a web server. Based on the error code in the exhibit, what is the most likely cause?

Accepted Answer

The service account credentials are invalid or locked.. The error code 0x8007052e corresponds to 'Logon failure: unknown user name or bad password'. In the context of Windows services, this indicates that the credentials provided for the service account are either incorrect or the account is locked out in Active Directory. Resolving this requires verifying the account password or checking for account lockouts in the domain controller logs to ensure the service can successfully authenticate.

Answer

The service account lacks the 'Log on as a service' right.

Answer

The network path to the domain controller is unreachable.

Answer

The service binary is corrupted or missing.

Question 13

A security engineer is hardening a Windows Server 2022 that hosts a Microsoft SQL Server instance. The server is domain-joined, and the SQL Server service currently runs under a domain user account. The engineer wants to implement a solution that provides automatic password management, supports Kerberos authentication, and allows the service to access network resources. The solution must also minimize the risk of password reuse across multiple servers. Which of the following should the engineer implement?

Accepted Answer

Group Managed Service Account (gMSA). A Group Managed Service Account (gMSA) is designed for services that need to access network resources and require automatic password management. It supports Kerberos and can be used across multiple servers without sharing the same password, reducing risk. The other account types either lack network access or cannot be shared across servers.

Answer

Standalone Managed Service Account (sMSA)

Answer

Virtual Service Account

Answer

Local Service account

Question 14

A security engineer is hardening a Windows Server 2019 domain controller. The organization wants to ensure that all service accounts used by critical services are managed automatically, with password rotation handled by Active Directory, and that the password is not stored locally on the server. Which of the following should the engineer implement?

Accepted Answer

Implement Group Managed Service Accounts (gMSAs) for the services.. Group Managed Service Accounts (gMSAs) are designed for automatic password management across multiple servers. Active Directory manages the password, rotating it every 30 days, and the password is not stored locally. This satisfies the need for domain-wide service accounts with no local password storage, unlike sMSAs, virtual accounts, or standard user accounts.

Answer

Use virtual accounts for each service.

Answer

Create standard domain user accounts and configure them with a long, complex password that never expires.

Answer

Configure each service to use a standalone Managed Service Account (sMSA).

Question 15

A security administrator is reviewing the security configuration of a Windows 10 workstation. The administrator notices that the workstation has the 'Secondary Logon' service disabled. Which of the following is the MOST likely impact of this configuration?

Accepted Answer

Users will be unable to run applications as a different user using the 'Run as different user' option.. The Secondary Logon service is responsible for allowing users to start processes under alternate credentials. Disabling it prevents the use of 'Run as different user' and runas.exe, but does not affect interactive logon, domain join, or Remote Desktop. Therefore, the most likely impact is the inability to run applications as a different user.

Answer

Users will be unable to log on interactively to the workstation.

Answer

Remote Desktop connections to the workstation will be blocked.

Answer

The workstation will be unable to join a domain.

Question 16

A security analyst is investigating a compromised Windows Server 2016 that is running an IIS web application. The analyst suspects that the attacker has created a malicious service to maintain persistence. Which of the following Windows Registry locations should the analyst examine to find the service's configuration?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Windows services are configured in the registry under HKLM\SYSTEM\CurrentControlSet\Services. Each service has a subkey with values like ImagePath and Start. A malicious service would create a subkey here to ensure it starts automatically. The other locations are used for different persistence mechanisms, such as user logon scripts or are non-existent.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Question 17

A security administrator is hardening a Windows Server 2022 that runs several critical services. The administrator wants to reduce the attack surface by restricting service permissions and ensuring that only authorized users can start, stop, or reconfigure services. Which TWO of the following actions should the administrator take? (Choose two.)

Accepted Answer

Use the SC command to set the service's security descriptor with a restricted DACL that grants only necessary permissions to specific groups.. To harden service permissions, the administrator should restrict the service's DACL using sc.exe sdset and disable unnecessary services via GPO. These actions limit who can control services and eliminate unneeded attack vectors. Granting broad permissions or running as Local System would weaken security, and changing recovery options does not address permissions.

Answer

Use the Services MMC snap-in to set each service's recovery options to 'Take No Action' on failure.

Answer

Configure the service to log on as the Local System account to ensure it has all necessary privileges.

Answer

Grant the 'Everyone' group the right to start and stop services to simplify management.

Question 18

A security analyst is reviewing Windows event logs to detect suspicious service installations. The analyst notices Event ID 7045 in the System log, indicating a new service was installed. The service name is 'UpdaterSvc', and the image path points to a binary in a user's temp folder. The analyst wants to determine the most likely security implication of this event. Which of the following best describes the risk?

Accepted Answer

The service represents a potential persistence mechanism used by an attacker to maintain access to the system.. Event ID 7045 in the System log indicates a new service was installed. When the service binary is located in a user's temp folder, it strongly suggests malicious activity, as legitimate services are installed in protected system directories. Attackers use services for persistence because they can start automatically and run with elevated privileges. The correct response is to treat this as a potential compromise and investigate further. The other options misinterpret the event or underestimate the risk.

Answer

The event indicates a driver installation, which could cause a blue screen of death.

Answer

The service is likely a legitimate Windows update service, and the event can be ignored.

Answer

The service installation is a sign of a Windows Update failure, and the system should be rolled back.

Question 19

A security engineer is hardening a Windows Server 2022 environment that hosts several critical services. The engineer wants to implement measures to protect against credential theft and privilege escalation via service accounts. Which two of the following actions should the engineer take? (Choose two.)

Accepted Answer

Implement a policy to regularly audit service accounts for excessive privileges and remove unnecessary rights, such as 'Act as part of the operating system' or 'Debug programs'.. The correct actions are to deploy gMSAs for domain-authenticated services and to audit and reduce service account privileges. gMSAs provide automatic password management and reduce credential theft risk. Auditing privileges ensures least privilege and removes dangerous rights. The other options either increase risk by granting excessive privileges or weaken security through reversible encryption or overly broad logon rights.

Answer

Assign the 'Log on as a service' right to all domain users to ensure that any service can start without interruption.

Answer

Configure all services to run under the Local System account to simplify management and ensure they have the necessary privileges.

Answer

Enable the 'Store passwords using reversible encryption' policy for all service accounts to allow easy recovery of passwords if needed.

Question 20

A company uses Microsoft Entra ID (formerly Azure AD) and has a critical line-of-business application that authenticates users via SAML 2.0. The security team wants to enforce multi-factor authentication (MFA) for this application without affecting other applications. They have Entra ID P1 licenses. What is the most appropriate way to achieve this?

Accepted Answer

Configure a Conditional Access policy that targets the specific application and requires MFA for all users.. Conditional Access policies in Entra ID allow administrators to enforce MFA for specific applications and users. This is the most granular and appropriate method when you have Entra ID P1 licenses. Security defaults apply tenant-wide, the per-application MFA setting is deprecated, and authentication method policies do not enforce MFA per application. Therefore, the correct solution is to create a Conditional Access policy targeting the line-of-business application.

Answer

Set up a per-application MFA setting in the Enterprise Applications blade by enabling the 'Require multi-factor authentication' option for the specific application.

Answer

Create a new authentication method policy that restricts MFA to only the users who need access to the application.

Answer

Enable security defaults in Entra ID, which will automatically enforce MFA for all users and applications.

GSEC Windows Services and MS Cloud — All Questions With Answers

A system administrator needs to ensure that a critical Windows service runs with the least privilege necessary while still maintaining access to a local database. Which account type provides a unique SID, limited network privileges, and a virtual account profile?

An administrator observes that the policy in the exhibit is failing to provide access to an authorized user working from a corporate VPN. The user's external IP is 203.0.113.5. What is the root cause of this access failure?

Exhibit

Which TWO of the following actions are best practice when securing Azure AD (Entra ID) service principals used for automated CI/CD pipelines?

Which THREE of the following are critical hardening steps for an Azure App Service hosting a sensitive public-facing web application?

You are auditing a Windows Server environment and identify that a service is configured to log on as a 'Group Managed Service Account' (gMSA). What is the primary security advantage of using this account type over a standard domain user account?

An administrator wants to prevent unauthorized modification of Windows Services. Which tool allows for the centralized management of service startup types and logon accounts across multiple domain-joined systems?

When auditing an Azure environment, you notice that a Virtual Machine is utilizing a User-Assigned Managed Identity. How does this differ from a System-Assigned Managed Identity?

You are troubleshooting a service startup failure on a web server. Based on the error code in the exhibit, what is the most likely cause?

Exhibit

A security administrator is reviewing the security configuration of a Windows 10 workstation. The administrator notices that the workstation has the 'Secondary Logon' service disabled. Which of the following is the MOST likely impact of this configuration?

GSEC Windows Services and MS Cloud — All Questions With Answers

A system administrator needs to ensure that a critical Windows service runs with the least privilege necessary while still maintaining access to a local database. Which account type provides a unique SID, limited network privileges, and a virtual account profile?

An administrator observes that the policy in the exhibit is failing to provide access to an authorized user working from a corporate VPN. The user's external IP is 203.0.113.5. What is the root cause of this access failure?

Exhibit

Which TWO of the following actions are best practice when securing Azure AD (Entra ID) service principals used for automated CI/CD pipelines?

Which THREE of the following are critical hardening steps for an Azure App Service hosting a sensitive public-facing web application?

You are auditing a Windows Server environment and identify that a service is configured to log on as a 'Group Managed Service Account' (gMSA). What is the primary security advantage of using this account type over a standard domain user account?

An administrator wants to prevent unauthorized modification of Windows Services. Which tool allows for the centralized management of service startup types and logon accounts across multiple domain-joined systems?

When auditing an Azure environment, you notice that a Virtual Machine is utilizing a User-Assigned Managed Identity. How does this differ from a System-Assigned Managed Identity?

You are troubleshooting a service startup failure on a web server. Based on the error code in the exhibit, what is the most likely cause?

Exhibit

A security administrator is reviewing the security configuration of a Windows 10 workstation. The administrator notices that the workstation has the 'Secondary Logon' service disabled. Which of the following is the MOST likely impact of this configuration?