GSEC Windows Automation and Auditing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -ne 'Running'}

  Why this is correct

  This command filters services where the StartType is 'Automatic' and the Status is not 'Running'. It directly returns the list of automatic services that are stopped or in another non-running state. The Where-Object cmdlet evaluates each service object, and the condition uses -and to combine both criteria. This is the most straightforward and accurate way to achieve the goal.

• ✗

  Get-Service -StartType Automatic | Where-Object {$_.Status -eq 'Stopped'}

  Why it's wrong here

  The Get-Service cmdlet does not have a -StartType parameter. While you can filter by -Name or -DisplayName, StartType is not a valid parameter. This command would produce an error. Even if it worked, it only checks for 'Stopped' status, missing services that are in 'Paused' or 'StartPending' states. The correct approach uses Get-Service without that parameter and then filters with Where-Object.

• ✗

  Get-Service | Where-Object {$_.StartType -eq 'Automatic' -or $_.Status -eq 'Stopped'}

  Why it's wrong here

  Using -or would return all automatic services regardless of status, plus all stopped services regardless of start type. This includes many services that are not automatic or not stopped, creating a large and inaccurate list. The goal is to find automatic services that are not running, so the condition must use -and, not -or. This command would not efficiently identify the desired services.

• ✗

  Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -eq 'Stopped'}

  Why it's wrong here

  This command filters for automatic services that are specifically 'Stopped'. While this might cover most cases, it excludes services that are in 'Paused', 'StartPending', or 'StopPending' states. The question asks for services not running, which includes any status other than 'Running'. Therefore, using -ne 'Running' is more accurate. This option is close but not fully correct.