GSEC Windows Services and MS Cloud — Timed 15 Questions

Question 1

A system administrator needs to ensure that a critical Windows service runs with the least privilege necessary while still maintaining access to a local database. Which account type provides a unique SID, limited network privileges, and a virtual account profile?

15 minute time limit — choose an answer to begin.

Accepted Answer

Virtual Account. Virtual Accounts were introduced in Windows 7/Server 2008 R2 to mitigate risks associated with over-privileged service accounts. They possess a unique SID, automatically manage passwords, and are restricted to the local machine, making them ideal for applications requiring database access without domain-wide network exposure. Utilizing these accounts significantly hardens the service environment by preventing lateral movement if the service process is compromised by an attacker.

Answer

LocalSystem account

Answer

NetworkService account

Answer

LocalService account

Question 2

An administrator observes that the policy in the exhibit is failing to provide access to an authorized user working from a corporate VPN. The user's external IP is 203.0.113.5. What is the root cause of this access failure?

Accepted Answer

The SourceIp condition does not match the requester IP.. The IAM policy explicitly restricts access to the specified S3 bucket to requests originating from the 192.168.1.0/24 subnet. Since the user is connecting from 203.0.113.5, which is outside the defined CIDR block, the condition is not met. Understanding how IP-based conditions function is critical for security auditing, as overly restrictive IP policies often cause legitimate operational failures while failing to protect against sophisticated bypass techniques like VPNs or proxies.

Answer

The Resource ARN is malformed.

Answer

The Action list is missing 's3:ListBucket'.

Answer

The Effect is set to 'Allow' instead of 'Deny'.

Question 3

Which TWO of the following actions are best practice when securing Azure AD (Entra ID) service principals used for automated CI/CD pipelines?

Accepted Answer

Use Managed Identities whenever possible to avoid secret management.. Securing service principals involves minimizing the attack surface by applying the principle of least privilege and utilizing non-persistent authentication methods. Using managed identities or short-lived certificates instead of long-lived secrets significantly lowers the risk of credential leakage. Regularly auditing these identities ensures that only necessary permissions remain active, preventing long-term exposure during an incident. These practices are essential for protecting cloud resources against unauthorized access or privilege escalation.

Answer

Assign the Global Administrator role for maximum visibility.

Answer

Rotate client secrets every 30 days.

Answer

Enable password writeback for the service principal.

Question 4

Which THREE of the following are critical hardening steps for an Azure App Service hosting a sensitive public-facing web application?

Accepted Answer

Configure Access Restrictions using IP allowlists.. Hardening a public-facing App Service requires a layered defense. Restricting network access ensures that only legitimate traffic reaches the application. Implementing managed identities removes the need for stored credentials. Finally, enabling diagnostic logging is essential for incident response, providing the visibility needed to detect and investigate potential attacks against the application. Combining these steps provides a robust security posture against common web vulnerabilities and unauthorized access attempts in cloud environments.

Answer

Disable Managed Identity and use a Service Principal.

Answer

Enable the 'Always On' feature for higher performance.

Question 5

A security analyst is reviewing a Windows Server 2022 event log and sees repeated Event ID 4625 (An account failed to log on) with Logon Type 4. The account name is a domain service account used by a custom backup service. Which of the following is the MOST likely explanation for these failed logon attempts?

Accepted Answer

The backup service is configured to log on as the service account, but the account lacks the 'Log on as a service' right on the server.. The repeated Event ID 4625 with Logon Type 4 points to a batch logon failure, which is characteristic of a service or scheduled task. When a service account lacks the 'Log on as a service' right, the Service Control Manager cannot perform the batch logon, resulting in these events. The other options either produce different logon types or different error patterns.

Answer

An attacker is performing a brute-force attack against the service account from a remote workstation.

Answer

A scheduled task is running under the service account and is failing due to an expired password.

Answer

The service account password has been changed recently and the service has not been restarted to pick up the new credentials.

Question 6

An administrator is auditing a Windows Server 2019 file server and notices that a scheduled task is configured to run under the built-in SYSTEM account. The task executes a PowerShell script that writes to a network share on a different server. The script fails with an access denied error when attempting to write to the share. The administrator confirms that the share permissions and NTFS permissions allow the computer account of the file server to write. What is the most likely reason for the failure?

Accepted Answer

The SYSTEM account is a local account and cannot be used for network authentication; therefore, the script must be configured to run under a domain user account that has permissions on the remote share.. The SYSTEM account is a local account that authenticates to network resources using the computer account credentials. While the computer account may have permissions on the share, there are scenarios where the computer account is not recognized or lacks the necessary rights, such as when the remote server is in a different domain or when the share permissions are not correctly configured for computer accounts. Running the task under a domain user account with explicit permissions ensures reliable network access. The other options misidentify the root cause or suggest irrelevant fixes.

Answer

The scheduled task is running under the SYSTEM account, which does not have a user profile and therefore cannot access mapped network drives or UNC paths that require user credentials.

Answer

The SYSTEM account on the file server does not have network access because it authenticates as the computer account, but the share is on a different server and the computer account lacks the necessary permissions.

Answer

The scheduled task is failing because the SYSTEM account does not have the 'Log on as a batch job' right, which is required for scheduled tasks to run and access network resources.

Question 7

A security administrator is investigating a potential compromise of a Windows Server that runs a custom service. The service is configured to log on as a domain user account, and the administrator suspects the account's credentials were dumped from memory. Which Windows security event ID should the administrator search for to detect attempts to access the Local Security Authority Subsystem Service (LSASS) process?

Accepted Answer

Event ID 4656. To detect attempts to access the LSASS process, security administrators should monitor for Event ID 4656, which indicates a handle to an object was requested. When an attacker tries to dump credentials, they request a handle to the LSASS process, generating this event if auditing is properly configured. Event ID 4624 is for logons, 4663 is for object access, and 4688 is for process creation; none of these directly capture the handle request to LSASS. Therefore, 4656 is the correct event ID to search for.

Answer

Event ID 4624

Answer

Event ID 4663

Answer

Event ID 4688

Question 8

A security engineer is reviewing a Windows Server 2022 domain controller's security log and notices Event ID 4625 (An account failed to log on) with Logon Type 3 and the process name 'lsass.exe'. The source workstation is a member server that hosts a service configured to run under a domain user account. The engineer suspects the service is failing because the account's password has expired. Which of the following is the most likely cause of the failed logons?

Accepted Answer

The service account's password has expired, and the service is using a cached credential that has not been updated.. The failed network logons with lsass.exe as the process indicate a service using a domain account. If the account's password expires and the service configuration is not updated, the service will continue to use the old password, causing authentication failures. This is a common issue when password expiration policies apply to service accounts without proper management.

Answer

The service account is not a member of the 'Log on as a service' right, preventing it from starting.

Answer

The service account is locked out due to multiple failed logon attempts.

Answer

The service account's password has exceeded the maximum age defined in the domain's fine-grained password policy.

Question 9

You are auditing a Windows Server environment and identify that a service is configured to log on as a 'Group Managed Service Account' (gMSA). What is the primary security advantage of using this account type over a standard domain user account?

Accepted Answer

They automatically rotate passwords without service restarts.. gMSAs provide automatic password management, where the Windows OS handles password rotation without manual intervention or service downtime. This significantly reduces the risk of password compromise or credential theft via brute-force or persistent local storage. By removing the need for human administrators to manage long-lived static credentials, gMSAs enforce a robust security posture that adheres to modern standards for service identity lifecycle management and long-term protection against credential-based lateral movement.

Answer

They enable Kerberos constrained delegation by default.

Answer

They bypass the need for an SPN registration.

Answer

They allow for local interactive logons on all domain controllers.

Question 10

An administrator wants to prevent unauthorized modification of Windows Services. Which tool allows for the centralized management of service startup types and logon accounts across multiple domain-joined systems?

Accepted Answer

Group Policy Management Console (GPMC). Group Policy Objects (GPO) are the standard mechanism in Windows environments to enforce security configurations, including service management, across an entire fleet. Centralized control ensures that security policies are applied consistently, preventing configuration drift and unauthorized changes that could be exploited by attackers. By leveraging GPOs, administrators can maintain a hardened baseline, which is a foundational requirement for both GIAC compliance standards and general enterprise cybersecurity best practices.

Answer

Task Scheduler

Answer

Services.msc

Answer

Local Security Policy (secpol.msc)

Question 11

When auditing an Azure environment, you notice that a Virtual Machine is utilizing a User-Assigned Managed Identity. How does this differ from a System-Assigned Managed Identity?

Accepted Answer

User-assigned identities exist as separate, independent Azure resources.. System-assigned identities are tied directly to the lifecycle of the Azure resource (e.g., the VM is deleted, the identity is deleted). User-assigned identities exist as independent resources in Azure, allowing them to be shared across multiple resources and managed independently. This flexibility is crucial for complex architectures where multiple services need to share access permissions without creating redundant identity objects, simplifying long-term identity lifecycle management and improving security granularity.

Answer

User-assigned identities do not require Entra ID authentication.

Answer

System-assigned identities can be shared across multiple resources.

Answer

System-assigned identities provide more granular permission scopes.

Question 12

You are troubleshooting a service startup failure on a web server. Based on the error code in the exhibit, what is the most likely cause?

Accepted Answer

The service account credentials are invalid or locked.. The error code 0x8007052e corresponds to 'Logon failure: unknown user name or bad password'. In the context of Windows services, this indicates that the credentials provided for the service account are either incorrect or the account is locked out in Active Directory. Resolving this requires verifying the account password or checking for account lockouts in the domain controller logs to ensure the service can successfully authenticate.

Answer

The service account lacks the 'Log on as a service' right.

Answer

The network path to the domain controller is unreachable.

Answer

The service binary is corrupted or missing.

Question 13

A security engineer is hardening a Windows Server 2022 that hosts a Microsoft SQL Server instance. The server is domain-joined, and the SQL Server service currently runs under a domain user account. The engineer wants to implement a solution that provides automatic password management, supports Kerberos authentication, and allows the service to access network resources. The solution must also minimize the risk of password reuse across multiple servers. Which of the following should the engineer implement?

Accepted Answer

Group Managed Service Account (gMSA). A Group Managed Service Account (gMSA) is designed for services that need to access network resources and require automatic password management. It supports Kerberos and can be used across multiple servers without sharing the same password, reducing risk. The other account types either lack network access or cannot be shared across servers.

Answer

Standalone Managed Service Account (sMSA)

Answer

Virtual Service Account

Answer

Local Service account

Question 14

A security engineer is hardening a Windows Server 2019 domain controller. The organization wants to ensure that all service accounts used by critical services are managed automatically, with password rotation handled by Active Directory, and that the password is not stored locally on the server. Which of the following should the engineer implement?

Accepted Answer

Implement Group Managed Service Accounts (gMSAs) for the services.. Group Managed Service Accounts (gMSAs) are designed for automatic password management across multiple servers. Active Directory manages the password, rotating it every 30 days, and the password is not stored locally. This satisfies the need for domain-wide service accounts with no local password storage, unlike sMSAs, virtual accounts, or standard user accounts.

Answer

Use virtual accounts for each service.

Answer

Create standard domain user accounts and configure them with a long, complex password that never expires.

Answer

Configure each service to use a standalone Managed Service Account (sMSA).

Question 15

A security administrator is reviewing the security configuration of a Windows 10 workstation. The administrator notices that the workstation has the 'Secondary Logon' service disabled. Which of the following is the MOST likely impact of this configuration?

Accepted Answer

Users will be unable to run applications as a different user using the 'Run as different user' option.. The Secondary Logon service is responsible for allowing users to start processes under alternate credentials. Disabling it prevents the use of 'Run as different user' and runas.exe, but does not affect interactive logon, domain join, or Remote Desktop. Therefore, the most likely impact is the inability to run applications as a different user.

Answer

Users will be unable to log on interactively to the workstation.

Answer

Remote Desktop connections to the workstation will be blocked.

Answer

The workstation will be unable to join a domain.