Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: How can tasks be scheduled to automatically execute on a specific periodic basis on a current Windows system? (Choose tw. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- How can tasks be scheduled to automatically execute on a specific periodic basis on a current Windows system?…
- What is the single key factor when deploying a NIDS on a switched network?
- Which of the following is NOT a benefit of a honeypot?
- Which of the following commands is NOT useful in log analysis on Linux?
- How can a system manager quickly and easily install the latest patches and new code for the installed softwar…
- When performing a periodic daily backup operation to protect the user data hosted on a Windows Server system…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. How can tasks be scheduled to automatically execute on a specific periodic basis on a current Windows system? (Choose two.)
Answer: A,C. A) Using the Task Scheduler GUI utility. || C) Executing the schtasks.exe command.
Modern Windows systems use the Task Scheduler graphical utility and the schtasks command line tool to schedule periodic tasks. The AT command is deprecated and removed from current versions, making it an incorrect choice for modern systems.
Q2. What is the single key factor when deploying a NIDS on a switched network?
Answer: D. D) SPAN port
Network intrusion detection systems must see all traffic to function effectively, so connecting to a switch SPAN or mirror port is essential. Without port mirroring, the switch isolates traffic, and the sensor remains blind to most network activity.
Q3. Which of the following is NOT a benefit of a honeypot?
Answer: D. D) Preventing unknown attacks
Honeypots are decoy systems designed to detect attacks and gather threat intelligence, but they do not prevent traffic from reaching their targets. Firewalls and intrusion prevention systems are responsible for blocking malicious network traffic.
Q4. Which of the following commands is NOT useful in log analysis on Linux?
Answer: C. C) type
The type command reveals command types and locations rather than file contents. For the exam, remember tail, more, and awk parse text; type does not.
Q5. How can a system manager quickly and easily install the latest patches and new code for the installed software on a Linux system? (Choose two.)
Answer: A,C. A) Use the apt-get upgrade command. || C) Use the yum tool.
The yum and apt-get upgrade commands efficiently install software patches on Linux. Avoid reinstalling the OS or booting from disks, as updates must occur within the running system.
Q6. When performing a periodic daily backup operation to protect the user data hosted on a Windows Server system, what type of backup process provides for the most efficient restoration procedure, no matter which day of the week a drive failur…
Answer: A. A) Daily full
Daily full backups ensure the most efficient restoration by requiring only one media set. While incremental backups take less time, they complicate restores.
Q7. You have been asked to set up auditing to track users' read and write events related to several folders of files essential to the company's daily operations. You configure the auditing settings on each of the NTFS hosted file objects. Howe…
Answer: A. A) The Audit object access event is not enabled.
You must enable Audit Object Access in Windows policy for file logs to appear. Simply configuring NTFS permissions is insufficient, as auditing is disabled by default.
Q8. When working with the Internet Explorer Web browser, into which security zone are safe public Web sites automatically categorized?
Answer: A. A) Internet zone
Safe public websites are automatically categorized into the Internet zone. The Intranet zone is reserved for local network resources, while Trusted Sites require manual addition by the user.
Q9. Which functions can be performed by a security administrator using the SECEDIT.EXE tool useful on a Windows network? (Choose all that apply)
Answer: B,D. B) Configure a system with a security template. || D) Analyze a system in comparison to a security template.
The SECEDIT command is used to configure a system with a security template or analyze it against one. Remember that SECEDIT operates locally and cannot extract templates across a network.
Q10. Why are security templates useful security management features for Windows systems? (Choose all that apply.)
Answer: A,B,C. A) They can be applied to a system to configure it || B) They can be used to compare against a configured system to detect differences || C) They can be extracted from manually configured systems
Security templates are useful because they can be applied to configure a system, used to compare against existing configurations, and extracted from manually set systems. They cannot quickly set object permissions.
Q11. In an attempt to configure your Windows workstation to support telecommuting, you enable RDP connectivity on your local client system. Once you get home and attempt to establish the remote desktop connection, it fails. Why did this remote…
Answer: A. A) Inbound TCP port 3389 connections are not allowed on the company network.
The inbound TCP port 3389 connections used by RDP are likely blocked by the company network firewall. Private networks typically block inbound connection initiations from the public internet.
Q12. Which of the following is NOT a feature of the Windows Firewall?
Answer: A. A) Filter based on packet content
Windows Firewall is a stateful packet filter, so it cannot inspect application layer payload content. For the exam, remember it filters traffic by port and IP address, and logs both successful connections and dropped packets.
Q13. When logging into a Windows client with a domain user account, which of the following is the most secure form of authentication?
Answer: C. C) A smart card with a 6-digit PIN
A smart card combined with a personal identification number provides secure multi-factor authentication, requiring both possession and knowledge. Remember that multi-factor authentication is always preferred over any single-factor method like a password or biometric alone.
Q14. Why should an administrator use a service pack instead of individual hotfixes?
Answer: A. A) A service pack is a single install of well-tested updates.
A service pack is a single, well-tested installation package that bundles many updates together. Relying on individual hotfixes is inefficient because each one addresses a single issue and may require a separate reboot.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.