GSEC Windows Services and MS Cloud — Timed 10 Questions

Question 1

A system administrator needs to ensure that a critical Windows service runs with the least privilege necessary while still maintaining access to a local database. Which account type provides a unique SID, limited network privileges, and a virtual account profile?

10 minute time limit — choose an answer to begin.

Accepted Answer

Virtual Account. Virtual Accounts were introduced in Windows 7/Server 2008 R2 to mitigate risks associated with over-privileged service accounts. They possess a unique SID, automatically manage passwords, and are restricted to the local machine, making them ideal for applications requiring database access without domain-wide network exposure. Utilizing these accounts significantly hardens the service environment by preventing lateral movement if the service process is compromised by an attacker.

Answer

LocalSystem account

Answer

NetworkService account

Answer

LocalService account

Question 2

An administrator observes that the policy in the exhibit is failing to provide access to an authorized user working from a corporate VPN. The user's external IP is 203.0.113.5. What is the root cause of this access failure?

Accepted Answer

The SourceIp condition does not match the requester IP.. The IAM policy explicitly restricts access to the specified S3 bucket to requests originating from the 192.168.1.0/24 subnet. Since the user is connecting from 203.0.113.5, which is outside the defined CIDR block, the condition is not met. Understanding how IP-based conditions function is critical for security auditing, as overly restrictive IP policies often cause legitimate operational failures while failing to protect against sophisticated bypass techniques like VPNs or proxies.

Answer

The Resource ARN is malformed.

Answer

The Action list is missing 's3:ListBucket'.

Answer

The Effect is set to 'Allow' instead of 'Deny'.

Question 3

Which TWO of the following actions are best practice when securing Azure AD (Entra ID) service principals used for automated CI/CD pipelines?

Accepted Answer

Use Managed Identities whenever possible to avoid secret management.. Securing service principals involves minimizing the attack surface by applying the principle of least privilege and utilizing non-persistent authentication methods. Using managed identities or short-lived certificates instead of long-lived secrets significantly lowers the risk of credential leakage. Regularly auditing these identities ensures that only necessary permissions remain active, preventing long-term exposure during an incident. These practices are essential for protecting cloud resources against unauthorized access or privilege escalation.

Answer

Assign the Global Administrator role for maximum visibility.

Answer

Rotate client secrets every 30 days.

Answer

Enable password writeback for the service principal.

Question 4

Which THREE of the following are critical hardening steps for an Azure App Service hosting a sensitive public-facing web application?

Accepted Answer

Configure Access Restrictions using IP allowlists.. Hardening a public-facing App Service requires a layered defense. Restricting network access ensures that only legitimate traffic reaches the application. Implementing managed identities removes the need for stored credentials. Finally, enabling diagnostic logging is essential for incident response, providing the visibility needed to detect and investigate potential attacks against the application. Combining these steps provides a robust security posture against common web vulnerabilities and unauthorized access attempts in cloud environments.

Answer

Disable Managed Identity and use a Service Principal.

Answer

Enable the 'Always On' feature for higher performance.

Question 5

A security analyst is reviewing a Windows Server 2022 event log and sees repeated Event ID 4625 (An account failed to log on) with Logon Type 4. The account name is a domain service account used by a custom backup service. Which of the following is the MOST likely explanation for these failed logon attempts?

Accepted Answer

The backup service is configured to log on as the service account, but the account lacks the 'Log on as a service' right on the server.. The repeated Event ID 4625 with Logon Type 4 points to a batch logon failure, which is characteristic of a service or scheduled task. When a service account lacks the 'Log on as a service' right, the Service Control Manager cannot perform the batch logon, resulting in these events. The other options either produce different logon types or different error patterns.

Answer

An attacker is performing a brute-force attack against the service account from a remote workstation.

Answer

A scheduled task is running under the service account and is failing due to an expired password.

Answer

The service account password has been changed recently and the service has not been restarted to pick up the new credentials.

Question 6

An administrator is auditing a Windows Server 2019 file server and notices that a scheduled task is configured to run under the built-in SYSTEM account. The task executes a PowerShell script that writes to a network share on a different server. The script fails with an access denied error when attempting to write to the share. The administrator confirms that the share permissions and NTFS permissions allow the computer account of the file server to write. What is the most likely reason for the failure?

Accepted Answer

The SYSTEM account is a local account and cannot be used for network authentication; therefore, the script must be configured to run under a domain user account that has permissions on the remote share.. The SYSTEM account is a local account that authenticates to network resources using the computer account credentials. While the computer account may have permissions on the share, there are scenarios where the computer account is not recognized or lacks the necessary rights, such as when the remote server is in a different domain or when the share permissions are not correctly configured for computer accounts. Running the task under a domain user account with explicit permissions ensures reliable network access. The other options misidentify the root cause or suggest irrelevant fixes.

Answer

The scheduled task is running under the SYSTEM account, which does not have a user profile and therefore cannot access mapped network drives or UNC paths that require user credentials.

Answer

The SYSTEM account on the file server does not have network access because it authenticates as the computer account, but the share is on a different server and the computer account lacks the necessary permissions.

Answer

The scheduled task is failing because the SYSTEM account does not have the 'Log on as a batch job' right, which is required for scheduled tasks to run and access network resources.

Question 7

A security administrator is investigating a potential compromise of a Windows Server that runs a custom service. The service is configured to log on as a domain user account, and the administrator suspects the account's credentials were dumped from memory. Which Windows security event ID should the administrator search for to detect attempts to access the Local Security Authority Subsystem Service (LSASS) process?

Accepted Answer

Event ID 4656. To detect attempts to access the LSASS process, security administrators should monitor for Event ID 4656, which indicates a handle to an object was requested. When an attacker tries to dump credentials, they request a handle to the LSASS process, generating this event if auditing is properly configured. Event ID 4624 is for logons, 4663 is for object access, and 4688 is for process creation; none of these directly capture the handle request to LSASS. Therefore, 4656 is the correct event ID to search for.

Answer

Event ID 4624

Answer

Event ID 4663

Answer

Event ID 4688

Question 8

A security engineer is reviewing a Windows Server 2022 domain controller's security log and notices Event ID 4625 (An account failed to log on) with Logon Type 3 and the process name 'lsass.exe'. The source workstation is a member server that hosts a service configured to run under a domain user account. The engineer suspects the service is failing because the account's password has expired. Which of the following is the most likely cause of the failed logons?

Accepted Answer

The service account's password has expired, and the service is using a cached credential that has not been updated.. The failed network logons with lsass.exe as the process indicate a service using a domain account. If the account's password expires and the service configuration is not updated, the service will continue to use the old password, causing authentication failures. This is a common issue when password expiration policies apply to service accounts without proper management.

Answer

The service account is not a member of the 'Log on as a service' right, preventing it from starting.

Answer

The service account is locked out due to multiple failed logon attempts.

Answer

The service account's password has exceeded the maximum age defined in the domain's fine-grained password policy.

Question 9

You are auditing a Windows Server environment and identify that a service is configured to log on as a 'Group Managed Service Account' (gMSA). What is the primary security advantage of using this account type over a standard domain user account?

Accepted Answer

They automatically rotate passwords without service restarts.. gMSAs provide automatic password management, where the Windows OS handles password rotation without manual intervention or service downtime. This significantly reduces the risk of password compromise or credential theft via brute-force or persistent local storage. By removing the need for human administrators to manage long-lived static credentials, gMSAs enforce a robust security posture that adheres to modern standards for service identity lifecycle management and long-term protection against credential-based lateral movement.

Answer

They enable Kerberos constrained delegation by default.

Answer

They bypass the need for an SPN registration.

Answer

They allow for local interactive logons on all domain controllers.

Question 10

An administrator wants to prevent unauthorized modification of Windows Services. Which tool allows for the centralized management of service startup types and logon accounts across multiple domain-joined systems?

Accepted Answer

Group Policy Management Console (GPMC). Group Policy Objects (GPO) are the standard mechanism in Windows environments to enforce security configurations, including service management, across an entire fleet. Centralized control ensures that security policies are applied consistently, preventing configuration drift and unauthorized changes that could be exploited by attackers. By leveraging GPOs, administrators can maintain a hardened baseline, which is a foundational requirement for both GIAC compliance standards and general enterprise cybersecurity best practices.

Answer

Task Scheduler

Answer

Services.msc

Answer

Local Security Policy (secpol.msc)