GSEC Windows as a Service Practice Question
A security administrator is troubleshooting an enterprise client that repeatedly fails to complete a major Windows feature upgrade, automatically triggering a rollback. Which built-in command-line utility should the administrator use to examine detailed migration logs, error codes, and rollback triggers?
⚠ Common exam trap
Test-takers frequently look into standard event viewer logs like Application or System for rollback causes, missing the dedicated standalone troubleshooting tool built specifically for upgrades.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SetupDiag.exe to automatically parse update setup logs and identify failure reasons
SetupDiag is a specialized diagnostic tool designed to analyze Windows setup logs and pinpoint the exact root cause of a failed feature update or rollback. Reviewing these logs allows security and systems engineers to rapidly identify blocking drivers, incompatible applications, or registry corruption preventing successful Windows as a Service upgrades.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SFC.exe /scannow to inspect operating system file integrity
Why it's wrong here
System File Checker verifies the integrity of protected system files and replaces corrupted components, but it is not designed to parse upgrade logs or determine feature update rollback causes. Relying on SFC will not reveal the specific application or driver conflict that halted the Windows installation.
- ✗
DISM.exe /Online /Cleanup-Image /RestoreHealth to repair component stores
Why it's wrong here
Deployment Image Servicing and Management repairs corruption within the local Windows component store and installation images. While useful for general OS health, it does not analyze the verbose migration logs generated during a failed feature update attempt.
- ✓
SetupDiag.exe to automatically parse update setup logs and identify failure reasons
Why this is correct
SetupDiag is the designated Microsoft utility that scans setup log files, extracts error codes, and details the exact conditions that caused a Windows feature update to fail and rollback. This tool dramatically accelerates troubleshooting by pointing directly to offending drivers or software.
- ✗
GPResult.exe /h report.html to generate a comprehensive group policy diagnostic report
Why it's wrong here
GPResult gathers and displays applied Group Policy settings and precedence for users and computers, but it has no visibility into operating system upgrade migration logs. It is utilized for policy auditing rather than diagnosing feature update rollbacks.
About these practice questions
One of 351 original GSEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.