Troubleshooting practice questions

A SIEM administrator is troubleshooting why Windows event logs forwarded from a domain controller are not being parsed correctly. The logs are sent using the Windows Event Forwarding (WEF) subscription, but the SIEM shows raw XML instead of normalized fields. The administrator confirms that the WEF subscription is active and events are arriving. Which action should the administrator take to ensure proper parsing?

Trap 1: Install a SIEM agent on the domain controller to read the event…

Installing a SIEM agent could bypass WEF and send logs in a format the SIEM understands, but it introduces additional management overhead and may not be necessary. The scenario specifies that WEF is already active and events are arriving; the problem is parsing, not collection. Adding an agent does not address the root cause and could create duplicate events if WEF remains enabled, complicating the SIEM data ingestion.

Trap 2: Configure the SIEM to use the Windows Event Log collector with the…

While using a Windows Event Log collector can help, the issue is that the logs are arriving as raw XML. Simply enabling XML parsing in the collector may not map the fields to the SIEM's schema. The collector must be configured with the appropriate event channel and a parsing ruleset that extracts fields from the XML structure. Without the correct parser, the SIEM will still store raw XML, so this action alone does not resolve the normalization problem.

Trap 3: Modify the WEF subscription to forward events in JSON format…

Windows Event Forwarding natively forwards events in XML format; there is no built-in option to change the output to JSON. While some third-party tools can convert XML to JSON, WEF itself does not support this. Attempting to modify the subscription to output JSON is not feasible and would not resolve the parsing issue. The correct approach is to adapt the SIEM's parser to the XML format.

A
Install a SIEM agent on the domain controller to read the event logs directly and forward them in a normalized format.
Why it fails: Installing a SIEM agent could bypass WEF and send logs in a format the SIEM understands, but it introduces additional management overhead and may not be necessary. The scenario specifies that WEF is already active and events are arriving; the problem is parsing, not collection. Adding an agent does not address the root cause and could create duplicate events if WEF remains enabled, complicating the SIEM data ingestion.
B
Configure the SIEM to use the Windows Event Log collector with the correct channel names and enable XML parsing.
Why it fails: While using a Windows Event Log collector can help, the issue is that the logs are arriving as raw XML. Simply enabling XML parsing in the collector may not map the fields to the SIEM's schema. The collector must be configured with the appropriate event channel and a parsing ruleset that extracts fields from the XML structure. Without the correct parser, the SIEM will still store raw XML, so this action alone does not resolve the normalization problem.
C
Modify the WEF subscription to forward events in JSON format instead of XML.
Why it fails: Windows Event Forwarding natively forwards events in XML format; there is no built-in option to change the output to JSON. While some third-party tools can convert XML to JSON, WEF itself does not support this. Attempting to modify the subscription to output JSON is not feasible and would not resolve the parsing issue. The correct approach is to adapt the SIEM's parser to the XML format.
D
Create a custom parser in the SIEM that extracts fields from the XML structure of the WEF events.
When WEF forwards events, they are encapsulated in XML. If the SIEM's default Windows parser expects a different format (e.g., EVTX or JSON), it will fail to extract fields, resulting in raw XML. Creating a custom parser that understands the WEF XML schema and maps fields like EventID, Computer, and SubjectUserName to the SIEM's normalized schema will enable proper parsing and correlation.

Question 2hardmultiple choice

A security administrator is troubleshooting access issues on a Windows file server. A user, Bob, is a member of the 'Sales' group, which has 'Read & Execute' on a folder. Bob is also a member of the 'Managers' group, which has 'Full Control' on the same folder. However, Bob cannot delete files. What is the most likely cause?

Trap 1: The 'Full Control' permission from 'Managers' does not include the…

Full Control includes all permissions, including Delete. Therefore, this statement is incorrect. If Bob truly had Full Control without any Deny, he would be able to delete files. The issue must be due to a conflicting Deny or another restriction. This option misrepresents the scope of Full Control.

Trap 2: Bob's user account has an explicit 'Deny' for 'Delete' that is…

While an explicit Deny for Bob would indeed block deletion, the scenario does not indicate that Bob's account has such a Deny. It only mentions group memberships. The most likely cause is a Deny on one of the groups, not on Bob directly. This option introduces an unsupported assumption.

Trap 3: The 'Read & Execute' permission from 'Sales' is more restrictive…

Windows permissions are additive: a user receives the union of all Allow permissions from all groups, unless a Deny is present. Read & Execute does not override Full Control; instead, the user would have Full Control if no Deny exists. This option incorrectly suggests that a less permissive Allow can override a more permissive Allow.

A
The 'Sales' group has an explicit 'Deny' for 'Delete' that overrides the 'Full Control' from 'Managers'.
If the Sales group has an explicit Deny for Delete, that Deny takes precedence over the Allow from Managers. Even though Bob is a Manager with Full Control, the Deny from Sales membership blocks deletion. This is a classic case of Deny overriding Allow, and it explains why Bob cannot delete files despite having Full Control via another group.
B
The 'Full Control' permission from 'Managers' does not include the 'Delete' permission.
Why it fails: Full Control includes all permissions, including Delete. Therefore, this statement is incorrect. If Bob truly had Full Control without any Deny, he would be able to delete files. The issue must be due to a conflicting Deny or another restriction. This option misrepresents the scope of Full Control.
C
Bob's user account has an explicit 'Deny' for 'Delete' that is inherited from the parent folder.
Why it fails: While an explicit Deny for Bob would indeed block deletion, the scenario does not indicate that Bob's account has such a Deny. It only mentions group memberships. The most likely cause is a Deny on one of the groups, not on Bob directly. This option introduces an unsupported assumption.
D
The 'Read & Execute' permission from 'Sales' is more restrictive and overrides the 'Full Control' from 'Managers'.
Why it fails: Windows permissions are additive: a user receives the union of all Allow permissions from all groups, unless a Deny is present. Read & Execute does not override Full Control; instead, the user would have Full Control if no Deny exists. This option incorrectly suggests that a less permissive Allow can override a more permissive Allow.

Question 3mediummultiple choice

A user reports they cannot open a downloaded application because macOS states the developer cannot be verified. Which security feature is preventing the execution of this application?

Trap 1: XProtect

XProtect acts as a signature-based scanner for known malware. It does not block applications based on the status of their developer signature or notarization status. Instead, it checks files against a list of known malicious signatures to prevent known threats from launching on the system.

Trap 2: System Integrity Protection

System Integrity Protection restricts modifications to the system itself, such as /System and /usr. It does not perform verification on downloaded third-party user applications. Therefore, it has no role in preventing the execution of a user-level application based on its developer identity or signature.

Trap 3: FileVault 2

FileVault 2 is responsible for encrypting the startup disk to protect data at rest. It does not have any functionality related to validating code signatures or developer identities for applications. It operates at the storage layer, not the application execution layer, and thus is unrelated here.

A
XProtect
Why it fails: XProtect acts as a signature-based scanner for known malware. It does not block applications based on the status of their developer signature or notarization status. Instead, it checks files against a list of known malicious signatures to prevent known threats from launching on the system.
B
Gatekeeper
Gatekeeper is the security feature that checks if an application is signed by an identified developer and notarized by Apple. If an application fails these checks, Gatekeeper prevents it from executing to ensure that the software has not been altered or created by an untrusted entity.
C
System Integrity Protection
Why it fails: System Integrity Protection restricts modifications to the system itself, such as /System and /usr. It does not perform verification on downloaded third-party user applications. Therefore, it has no role in preventing the execution of a user-level application based on its developer identity or signature.
D
FileVault 2
Why it fails: FileVault 2 is responsible for encrypting the startup disk to protect data at rest. It does not have any functionality related to validating code signatures or developer identities for applications. It operates at the storage layer, not the application execution layer, and thus is unrelated here.

Question 4hardmultiple choice

A security administrator is troubleshooting an enterprise client that repeatedly fails to complete a major Windows feature upgrade, automatically triggering a rollback. Which built-in command-line utility should the administrator use to examine detailed migration logs, error codes, and rollback triggers?

Trap 1: SFC.exe /scannow to inspect operating system file integrity

System File Checker verifies the integrity of protected system files and replaces corrupted components, but it is not designed to parse upgrade logs or determine feature update rollback causes. Relying on SFC will not reveal the specific application or driver conflict that halted the Windows installation.

Trap 2: DISM.exe /Online /Cleanup-Image /RestoreHealth to repair component…

Deployment Image Servicing and Management repairs corruption within the local Windows component store and installation images. While useful for general OS health, it does not analyze the verbose migration logs generated during a failed feature update attempt.

Trap 3: GPResult.exe /h report.html to generate a comprehensive group…

GPResult gathers and displays applied Group Policy settings and precedence for users and computers, but it has no visibility into operating system upgrade migration logs. It is utilized for policy auditing rather than diagnosing feature update rollbacks.

A
SFC.exe /scannow to inspect operating system file integrity
Why it fails: System File Checker verifies the integrity of protected system files and replaces corrupted components, but it is not designed to parse upgrade logs or determine feature update rollback causes. Relying on SFC will not reveal the specific application or driver conflict that halted the Windows installation.
B
DISM.exe /Online /Cleanup-Image /RestoreHealth to repair component stores
Why it fails: Deployment Image Servicing and Management repairs corruption within the local Windows component store and installation images. While useful for general OS health, it does not analyze the verbose migration logs generated during a failed feature update attempt.
C
SetupDiag.exe to automatically parse update setup logs and identify failure reasons
SetupDiag is the designated Microsoft utility that scans setup log files, extracts error codes, and details the exact conditions that caused a Windows feature update to fail and rollback. This tool dramatically accelerates troubleshooting by pointing directly to offending drivers or software.
D
GPResult.exe /h report.html to generate a comprehensive group policy diagnostic report
Why it fails: GPResult gathers and displays applied Group Policy settings and precedence for users and computers, but it has no visibility into operating system upgrade migration logs. It is utilized for policy auditing rather than diagnosing feature update rollbacks.

Question 5mediummultiple choice

You are troubleshooting a service startup failure on a web server. Based on the error code in the exhibit, what is the most likely cause?

Exhibit

Refer to the exhibit: {"Error": "Service did not start due to logon failure", "ErrorCode": "0x8007052e", "LogonAccount": "DOMAIN\svc_app", "Machine": "SRV-WEB-01"}

Trap 1: The service account lacks the 'Log on as a service' right.

If the account lacked the specific user right, the error code would typically reflect a privilege issue rather than an authentication failure. Error 0x8007052e specifically points to an incorrect credential or account status, which is a distinct problem from missing local security policy assignments on the host machine.

Trap 2: The network path to the domain controller is unreachable.

Connectivity issues to the domain controller would typically result in different network-related error codes or timeout errors. Since the system is reporting a specific logon failure, it indicates that the authentication request reached the domain controller but was rejected, rather than failing to reach the authentication service entirely.

Trap 3: The service binary is corrupted or missing.

A corrupted binary would typically result in a 'Service failed to start' error unrelated to logon credentials. The presence of a specific logon error code confirms that the service manager successfully located and attempted to execute the service, but failed during the authentication phase with the specified domain account.

A
The service account lacks the 'Log on as a service' right.
Why it fails: If the account lacked the specific user right, the error code would typically reflect a privilege issue rather than an authentication failure. Error 0x8007052e specifically points to an incorrect credential or account status, which is a distinct problem from missing local security policy assignments on the host machine.
B
The service account credentials are invalid or locked.
Error 0x8007052e is the Windows system code for 'Logon failure: unknown user name or bad password'. This confirms that the service manager attempted to authenticate the service account with Active Directory, but the credentials were rejected, likely due to a password mismatch, expired password, or account lockout.
C
The network path to the domain controller is unreachable.
Why it fails: Connectivity issues to the domain controller would typically result in different network-related error codes or timeout errors. Since the system is reporting a specific logon failure, it indicates that the authentication request reached the domain controller but was rejected, rather than failing to reach the authentication service entirely.
D
The service binary is corrupted or missing.
Why it fails: A corrupted binary would typically result in a 'Service failed to start' error unrelated to logon credentials. The presence of a specific logon error code confirms that the service manager successfully located and attempted to execute the service, but failed during the authentication phase with the specified domain account.

Question 6mediummultiple choice

A security administrator is troubleshooting a Windows 10 Enterprise device that is not receiving feature updates from Windows Update for Business. The administrator confirms that the device is connected to the network and has the correct Windows Update for Business policies applied. The administrator suspects that a Group Policy setting is overriding the Windows Update for Business configuration. Which Group Policy setting should the administrator check first?

Trap 1: Turn off Automatic Updates.

The 'Turn off Automatic Updates' policy, if enabled, disables automatic updates entirely. However, this policy is deprecated and may not affect Windows Update for Business in Windows 10. It is less specific than the policy that blocks connections to Windows Update Internet locations. While it could prevent updates, it is not the most likely override in a Windows Update for Business scenario.

Trap 2: Configure Automatic Updates.

The 'Configure Automatic Updates' policy controls how updates are downloaded and installed, but it does not specifically override Windows Update for Business deferrals. If set to disabled, it might prevent updates, but the scenario indicates policies are applied and the device is not receiving updates, so this is less likely the primary override. Other policies are more directly related to feature update management.

Trap 3: Select when Feature Updates are received.

The 'Select when Feature Updates are received' policy is actually a Windows Update for Business setting that can be configured via Group Policy. It allows you to set deferrals and pauses. If this policy is configured, it might be the intended setting, but it does not override Windows Update for Business; it is part of it. The question asks for a Group Policy setting that could override the configuration, so this is not the best answer.

A
Turn off Automatic Updates.
Why it fails: The 'Turn off Automatic Updates' policy, if enabled, disables automatic updates entirely. However, this policy is deprecated and may not affect Windows Update for Business in Windows 10. It is less specific than the policy that blocks connections to Windows Update Internet locations. While it could prevent updates, it is not the most likely override in a Windows Update for Business scenario.
B
Configure Automatic Updates.
Why it fails: The 'Configure Automatic Updates' policy controls how updates are downloaded and installed, but it does not specifically override Windows Update for Business deferrals. If set to disabled, it might prevent updates, but the scenario indicates policies are applied and the device is not receiving updates, so this is less likely the primary override. Other policies are more directly related to feature update management.
C
Select when Feature Updates are received.
Why it fails: The 'Select when Feature Updates are received' policy is actually a Windows Update for Business setting that can be configured via Group Policy. It allows you to set deferrals and pauses. If this policy is configured, it might be the intended setting, but it does not override Windows Update for Business; it is part of it. The question asks for a Group Policy setting that could override the configuration, so this is not the best answer.
D
Do not connect to any Windows Update Internet locations.
This policy, when enabled, prevents the device from connecting to Windows Update or Windows Update for Business servers, effectively blocking updates. It can override Windows Update for Business settings by preventing the device from reaching the update service. If this policy is set, the device will not receive feature updates even if Windows Update for Business policies are correctly applied. This is a common cause of update failure in managed environments.

Question 7hardmulti select

Which TWO of the following actions are primarily restricted by macOS System Integrity Protection (SIP)?

Trap 1: Installing unsigned applications from the internet

Gatekeeper, not SIP, governs the installation of unsigned applications. Gatekeeper performs code signing checks upon execution or disk image mounting. While SIP protects system-level files, the decision to allow or block the installation of third-party, non-Apple-signed applications is handled by policy controls within the Gatekeeper sub-system.

Trap 2: Accessing user-defined keychain items

Keychain access is managed by the Security framework and user authorization prompts, not SIP. SIP focuses on protecting the operating system files and kernel state, whereas Keychain access control is a separate logical layer designed to protect sensitive user credentials and cryptographic keys from unauthorized process access.

Trap 3: Encrypting the user home directory

Home directory encryption is managed by FileVault 2, which provides transparent, volume-level encryption for the startup disk. SIP is an integrity mechanism rather than a data-at-rest protection service, and thus has no functional role in the encryption of user home directories or disk volumes.

A
Modifying files within the /System directory
The /System directory contains core macOS components that are essential for system stability and security. SIP explicitly prevents the root user from writing to or modifying files in this path, ensuring that core binaries and libraries remain untampered throughout the lifecycle of the operating system.
B
Installing unsigned applications from the internet
Why it fails: Gatekeeper, not SIP, governs the installation of unsigned applications. Gatekeeper performs code signing checks upon execution or disk image mounting. While SIP protects system-level files, the decision to allow or block the installation of third-party, non-Apple-signed applications is handled by policy controls within the Gatekeeper sub-system.
C
Loading unsigned kernel extensions (kexts)
SIP mandates that only kernel extensions signed by a valid Apple Developer ID may be loaded. This prevents malicious actors from loading unsigned rootkits or drivers that could bypass security controls. By enforcing cryptographic signatures for kexts, the system maintains a secure chain of trust at the kernel level.
D
Accessing user-defined keychain items
Why it fails: Keychain access is managed by the Security framework and user authorization prompts, not SIP. SIP focuses on protecting the operating system files and kernel state, whereas Keychain access control is a separate logical layer designed to protect sensitive user credentials and cryptographic keys from unauthorized process access.
E
Encrypting the user home directory
Why it fails: Home directory encryption is managed by FileVault 2, which provides transparent, volume-level encryption for the startup disk. SIP is an integrity mechanism rather than a data-at-rest protection service, and thus has no functional role in the encryption of user home directories or disk volumes.

Read the full DNS explanation →

Question 8easymultiple choice

A help desk technician is troubleshooting a user's inability to reach an internal web application by its hostname, although the application is reachable by IP address. The user's workstation is configured with a DNS server address that is reachable. Which command should the technician run first to verify name resolution from the workstation?

Trap 1: netstat -an

netstat -an lists local sockets and their states; it shows whether the workstation has open connections but says nothing about DNS resolution. The user can already reach the application by IP, so socket state is not the failing component. Running netstat would not confirm whether the hostname resolves, making it a poor first diagnostic choice for this specific symptom.

Trap 2: ipconfig /all

ipconfig /all displays adapter configuration, including the configured DNS server addresses, but it does not perform a lookup. It can confirm that a DNS server is configured, yet it cannot tell the technician whether that server resolves the internal name. Since the scenario already states the DNS server address is reachable, this command adds little diagnostic value compared with an actual query.

Trap 3: tracert app.internal.example.com

tracert traces the Layer 3 path to a destination and requires the destination to be resolvable to an IP first. If name resolution is the problem, this command fails before it can produce useful path information, or it resolves the name using the same broken resolver. It does not isolate DNS from routing, so it is not the best first step here.

A
netstat -an
Why it fails: netstat -an lists local sockets and their states; it shows whether the workstation has open connections but says nothing about DNS resolution. The user can already reach the application by IP, so socket state is not the failing component. Running netstat would not confirm whether the hostname resolves, making it a poor first diagnostic choice for this specific symptom.
B
ipconfig /all
Why it fails: ipconfig /all displays adapter configuration, including the configured DNS server addresses, but it does not perform a lookup. It can confirm that a DNS server is configured, yet it cannot tell the technician whether that server resolves the internal name. Since the scenario already states the DNS server address is reachable, this command adds little diagnostic value compared with an actual query.
C
nslookup app.internal.example.com
nslookup queries DNS servers directly and reports the resolved address or an error, which quickly confirms whether the configured resolver can resolve the internal hostname. Because the application works by IP, the failure is isolated to name resolution, and this command tests exactly that path. It is available on Windows, Linux, and macOS and is the appropriate first diagnostic step in this scenario.
D
tracert app.internal.example.com
Why it fails: tracert traces the Layer 3 path to a destination and requires the destination to be resolvable to an IP first. If name resolution is the problem, this command fails before it can produce useful path information, or it resolves the name using the same broken resolver. It does not isolate DNS from routing, so it is not the best first step here.

Question 9mediummultiple choice

A system administrator notices that a user account has 'Read' permissions to a folder but is unable to access the files within it. Which Windows security mechanism is most likely restricting the user's access despite the NTFS permission settings?

Trap 1: User Account Control (UAC)

UAC primarily manages administrative elevation prompts and integrity levels for applications. It does not control low-level file system access permissions for standard users, nor does it impact the intersection between NTFS and Share permissions during remote or local folder access requests for standard data files.

Trap 2: BitLocker Drive Encryption

BitLocker provides full-volume encryption to protect data at rest against physical theft. It operates at the storage layer and does not perform access control checks based on user identity once the volume is unlocked and the operating system has successfully mounted the file system.

Trap 3: Group Policy Object (GPO) Inheritance

GPO inheritance dictates configuration settings and registry keys pushed from a domain controller. While GPOs can restrict software execution or modify user rights, they do not directly evaluate or override individual folder-level access control entries during standard file system navigation operations.

A
User Account Control (UAC)
Why it fails: UAC primarily manages administrative elevation prompts and integrity levels for applications. It does not control low-level file system access permissions for standard users, nor does it impact the intersection between NTFS and Share permissions during remote or local folder access requests for standard data files.
B
BitLocker Drive Encryption
Why it fails: BitLocker provides full-volume encryption to protect data at rest against physical theft. It operates at the storage layer and does not perform access control checks based on user identity once the volume is unlocked and the operating system has successfully mounted the file system.
C
Share Permissions
Share permissions act as the first gatekeeper for network resources. If the Share permission is set to 'Deny' or does not include the user, they cannot access the contents regardless of their NTFS permissions. Both layers must permit access for the user to view or modify files.
D
Group Policy Object (GPO) Inheritance
Why it fails: GPO inheritance dictates configuration settings and registry keys pushed from a domain controller. While GPOs can restrict software execution or modify user rights, they do not directly evaluate or override individual folder-level access control entries during standard file system navigation operations.