GSEC

Correct answer: C. C) Workgroup clients

Domain user accounts are strictly managed by Active Directory, meaning they can only authenticate to systems within their own domain or a trusted domain. Workgroups operate as decentralized peer-to-peer networks without a central directory, so domain credentials are completely invalid there.

Correct answer: C. C) It helps detect abnormalities.

Establishing a system baseline defines what normal network or system performance looks like, which is critical for identifying anomalies and potential security incidents. Administrators set warning thresholds based on deviations from this baseline, but baselining itself does not automatically prevent system downtime.

Correct answer: B. B) Altering the authorization of user groups on shared resources

Auditing strictly involves monitoring, recording, and analyzing system activity to ensure security compliance. Altering user authorizations is an active system administration task that should be monitored by an audit trail, but it is not an auditing function itself.

Correct answer: C. C) Open the Shared Folders utility from Computer Management. · D. D) Open a command prompt, and type net share.

Administrative and hidden shares are not visible through standard network browsing or the Run dialog. To view these specific shares, administrators must use command-line utilities like net share or the Shared Folders management console.

Correct answer: A. A) It has knowledge of what constitutes legitimate communications.

Stateful inspection tracks the state of network connections, allowing the firewall to distinguish between legitimate traffic and malicious packets like unsolicited scans. Static packet filtering handles basic IP and port blocking, but lacks this connection awareness.

Correct answer: A. A) Scanning and enumeration

Scanning and enumeration actively probe a target network to map live IP addresses and discover open ports. Information gathering focuses on passive reconnaissance, while gaining and maintaining access occur after vulnerabilities are identified.

Correct answer: A. A) Transport mode VPN

Transport mode VPNs encrypt the payload but leave original IP headers visible. Use tunnel mode to encapsulate the original header and hide internal addresses during transmission.

Correct answer: C. C) After testing

Patches must be installed only after thorough testing to prevent production downtime. Installing immediately upon release risks breaking systems if compatibility issues exist.

Correct answer: D. D) Users

Users is not a default Windows event log. Remember the classic triad of system, security, and application logs when analyzing Windows auditing and troubleshooting.

Correct answer: D. D) Configuring your system to auto-logon after booting

Configuring a system to auto-logon defeats the protection provided by full disk encryption. Once the system boots automatically, the decryption key is exposed to the logged-in account.

Correct answer: C. C) Salting

The NTLMv2 hashing algorithm does not use salting. Salting appends random values to passwords before hashing to mask duplicates, making cracking attacks significantly harder.

Correct answer: C. C) One

A hotfix is specifically designed to address only a single issue. Since hotfixes undergo less rigorous testing, it is generally recommended to wait for a fully tested cumulative update.

Correct answer: D. D) To be notified automatically of issues concerning products under their management

Administrators subscribe to these bulletins to receive automatic notifications about critical issues affecting their managed products. This timely information is vital for protecting infrastructure from compromise.

Correct answer: C. C) Set an SACL on each Registry key to be monitored.

You must set a System Access Control List on each specific Registry key to be monitored. Simply enabling the master Audit Policy setting is insufficient without configuring the target objects.

Correct answer: A. A) WSUS

Windows Server Update Services provides the exact enterprise patch management capabilities described. It downloads updates, allows internal approval, and distributes them to native clients. Tools like MBSA only scan.

Correct answer: A. A) A hierarchical collection of trusted domains

An Active Directory forest is defined as a hierarchical collection of trusted domains that share a common global catalog and schema. For the exam, remember that a tree is a series of linked domains sharing a contiguous namespace, while a forest links multiple trees together.

Correct answer: A. A) Block unauthorized executables

Software restriction policies improve security by blocking unauthorized executables from running, essentially acting as an application allow list. Do not confuse this with network firewalls, which filter application communications, or access control, which limits user permissions.

Correct answer: A. A) Start with implicit deny, accumulate allows, and subtract any denials.

NTFS effective permissions are calculated by starting with an implicit deny, accumulating all assigned allow permissions, and then explicitly subtracting any specific deny permissions. Remember this rule locally, but when accessing via network share, the most restrictive permission applies.

Correct answer: C. C) Centralized authentication

Active Directory is critically important because it provides centralized authentication and security policy enforcement across a network. Be careful not to confuse it with simple resource sharing protocols or network routing mechanisms.

Correct answer: A. A) Interruption of business tasks

Enterprises disable automatic updates because untested patches can interrupt critical business tasks or cause downtime. Remember the core security concept of patch management: always test updates in a staging environment before deployment.

Correct answer: B. B) Reverting password after account lockout

Reverting a password after an account lockout is not a valid feature of the Windows account lockout policy. The three main policy settings you need to know are account lockout duration, account lockout threshold, and resetting the lockout counter.

Correct answer: B. B) To reference the storage device hosting the operating system

The environmental variable percent SYSTEMDRIVE percent specifies the storage device hosting the Windows operating system. Administrators use these variables in scripts so they run correctly across multiple machines without hard-coding a specific drive letter.

Correct answer: B. B) XML

Internet Information Services natively supports W3C, IIS, NCSA, and custom logging formats, but it does not natively support XML logging. For the exam, memorize the specific built-in logging formats available in the IIS manager.

Correct answer: D. D) A network with the correct name of your employer, even though you are far away from the office

An attacker uses a rogue access point with a trusted network name to create an evil twin and steal your data. You should avoid connecting to a familiar network name when you are physically too far away from the legitimate office.

Correct answer: D. D) Users have a tendency to pick poor passwords even after training.

Users often pick poor passwords or revert to bad habits despite receiving comprehensive security awareness training. Technical enforcement through a password policy is required to guarantee minimum length and complexity requirements.

Correct answer: B. B) SMB

Windows uses the Server Message Block protocol for file and print sharing operations across a network. TCP/IP is the underlying transport suite, while DHCP handles dynamic IP addressing rather than managing shared resources.

Correct answer: C. C) Perform a device driver rollback

Performing a device driver rollback is the fastest way to uninstall the faulty driver and restore the previous working version. System Restore points or full backups might alter unrelated system settings, so always try the simplest component fix.

Correct answer: A. A) Reduce the number of attack points

Securely managing default services reduces the attack surface by disabling unnecessary components. This system hardening practice eliminates potential attack vectors. Improved boot times or reduced latency are secondary benefits, not the core security goal.

Correct answer: A. A) OSPF

OSPF is a link-state routing protocol, not a virtual private network protocol. Windows supports VPN protocols like SSTP, L2TP, and PPTP. Associate routing protocols with traffic path selection rather than secure tunnel creation.

Correct answer: A. A) Using the Task Scheduler GUI utility. · C. C) Executing the schtasks.exe command.

Modern Windows systems use the Task Scheduler graphical utility and the schtasks command line tool to schedule periodic tasks. The AT command is deprecated and removed from current versions, making it an incorrect choice for modern systems.

Correct answer: D. D) SPAN port

Network intrusion detection systems must see all traffic to function effectively, so connecting to a switch SPAN or mirror port is essential. Without port mirroring, the switch isolates traffic, and the sensor remains blind to most network activity.

Correct answer: D. D) Preventing unknown attacks

Honeypots are decoy systems designed to detect attacks and gather threat intelligence, but they do not prevent traffic from reaching their targets. Firewalls and intrusion prevention systems are responsible for blocking malicious network traffic.

Correct answer: C. C) type

The type command reveals command types and locations rather than file contents. For the exam, remember tail, more, and awk parse text; type does not.

Correct answer: A. A) Use the apt-get upgrade command. · C. C) Use the yum tool.

The yum and apt-get upgrade commands efficiently install software patches on Linux. Avoid reinstalling the OS or booting from disks, as updates must occur within the running system.

Correct answer: A. A) Daily full

Daily full backups ensure the most efficient restoration by requiring only one media set. While incremental backups take less time, they complicate restores.

Correct answer: A. A) The Audit object access event is not enabled.

You must enable Audit Object Access in Windows policy for file logs to appear. Simply configuring NTFS permissions is insufficient, as auditing is disabled by default.

Correct answer: A. A) Internet zone

Safe public websites are automatically categorized into the Internet zone. The Intranet zone is reserved for local network resources, while Trusted Sites require manual addition by the user.

Correct answer: B. B) Configure a system with a security template. · D. D) Analyze a system in comparison to a security template.

The SECEDIT command is used to configure a system with a security template or analyze it against one. Remember that SECEDIT operates locally and cannot extract templates across a network.

Correct answer: A. A) They can be applied to a system to configure it · B. B) They can be used to compare against a configured system to detect differences · C. C) They can be extracted from manually configured systems

Security templates are useful because they can be applied to configure a system, used to compare against existing configurations, and extracted from manually set systems. They cannot quickly set object permissions.

Correct answer: A. A) Inbound TCP port 3389 connections are not allowed on the company network.

The inbound TCP port 3389 connections used by RDP are likely blocked by the company network firewall. Private networks typically block inbound connection initiations from the public internet.

Correct answer: A. A) Filter based on packet content

Windows Firewall is a stateful packet filter, so it cannot inspect application layer payload content. For the exam, remember it filters traffic by port and IP address, and logs both successful connections and dropped packets.

Correct answer: C. C) A smart card with a 6-digit PIN

A smart card combined with a personal identification number provides secure multi-factor authentication, requiring both possession and knowledge. Remember that multi-factor authentication is always preferred over any single-factor method like a password or biometric alone.

Correct answer: A. A) A service pack is a single install of well-tested updates.

A service pack is a single, well-tested installation package that bundles many updates together. Relying on individual hotfixes is inefficient because each one addresses a single issue and may require a separate reboot.

Correct answer: D. D) System/hardware

System or hardware is not a valid selectable identity for granting resource permissions in Windows. Valid options include built-in groups like Authenticated Users, Everyone, and Anonymous Logon, which are used to manage access control lists.

Correct answer: D. D) Broadcast

Broadcast is a networking concept, not a standard Windows user group category. The standard group scopes in Windows are Local, Global, and Universal, which are essential for managing permissions and group nesting strategies.

Correct answer: A. A) Disable unnecessary services. · B. B) Configure specific registry values. · C. C) Design system role-specific security settings. · D. D) Create, edit, apply, and roll back a security policy.

The Security Configuration Wizard handles all these tasks by creating policies that disable services and tweak registry values. It generates an XML policy file, which is distinct from standard INF security templates, to manage role-based settings.

Correct answer: C. C) Being able to print to a network printer

Printing to a network printer is an object permission, not a system-wide user right. User rights govern logon abilities and system-level privileges like changing the system time or backing up files, which are assigned through local policies.

Correct answer: B. B) Local, Site, Domain, Organizational Unit

Group Policy objects are applied in the order of Local, Site, Domain, and Organizational Unit. Because policies applied last take precedence, Organizational Unit settings overwrite earlier ones. Use the LSDOU mnemonic to easily recall this processing order on the exam.

Correct answer: A. A) Using IPSec policies

Windows systems are configured for specific IPsec connections using IPsec policies. These policies determine how traffic is filtered and secured. Watch for distractors like configuration files, as IPsec relies entirely on defined policies.

Correct answer: D. D) Ticket-granting ticket

A ticket-granting ticket is issued after successful authentication to the Kerberos Key Distribution Center. The user submits this ticket to request service tickets for specific resources. Avoid confusing this with generic access tokens or web session cookies.

Correct answer: B. B) To protect against unauthorized resource access

These controls combine to protect against unauthorized resource access. Encryption secures data at rest and in transit, while multi-factor authentication validates user identities. None of these measures directly prevent malware infections or stop denial of service attacks.

Correct answer: B. B) A collection of registry settings used to enforce security and function

Windows group policy is a collection of registry settings used to enforce security and functionality across systems. It pushes centralized configurations to users and computers. Do not confuse group policy with organizational access guidelines or group membership rules.

Correct answer: A. A) LKGC

Last Known Good Configuration restores the registry to its state after the last successful login, offering a single recovery chance before a new logon overwrites it. System restore points and driver rollbacks can be used repeatedly, regardless of recent login events.

Correct answer: A. A) When there are ten or more systems

Microsoft recommends migrating from a workgroup to a client/server domain model once a network reaches about ten systems due to management overhead. At this scale, decentralized local user accounts become difficult to secure and manage efficiently.

Correct answer: B. B) It creates backups of system components.

Restore points snapshot system components like drivers and registries. Do not rely on them for user data backups or full system recovery after catastrophic loss.

Correct answer: D. D) Encrypt all communications.

Encrypting all communications protects data in transit between the web server and clients. Transport Layer Security prevents eavesdropping and modification of network payloads. Requiring longer passwords helps, but fails to secure the overall transmission channel.

Correct answer: D. D) Implement a single sign-on (SSO) policy.

Implementing single sign-on to allow internal credentials for external public access is not necessary and introduces risk. Internal credentials should remain separate from public-facing services. Defense in depth, patching, and strict authentication remain critical.