Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which of the following is NOT an option when granting permissions to access a resource on a Windows system?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- Which of the following is NOT an option when granting permissions to access a resource on a Windows system?
- Which of the following is NOT a standard Windows user group?
- Which of the following tasks can an administrator complete using the Security Configuration Wizard in Windows…
- Which of the following is NOT a user right?
- How are multiple group policies applied to a Windows client system?
- How are Windows systems configured to support specific IPSec connections?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which of the following is NOT an option when granting permissions to access a resource on a Windows system?
Answer: D. D) System/hardware
System or hardware is not a valid selectable identity for granting resource permissions in Windows. Valid options include built-in groups like Authenticated Users, Everyone, and Anonymous Logon, which are used to manage access control lists.
Q2. Which of the following is NOT a standard Windows user group?
Answer: D. D) Broadcast
Broadcast is a networking concept, not a standard Windows user group category. The standard group scopes in Windows are Local, Global, and Universal, which are essential for managing permissions and group nesting strategies.
Q3. Which of the following tasks can an administrator complete using the Security Configuration Wizard in Windows? (Choose all that apply.)
Answer: A,B,C,D. A) Disable unnecessary services. || B) Configure specific registry values. || C) Design system role-specific security settings. || D) Create, edit, apply, and roll back a security policy.
The Security Configuration Wizard handles all these tasks by creating policies that disable services and tweak registry values. It generates an XML policy file, which is distinct from standard INF security templates, to manage role-based settings.
Q4. Which of the following is NOT a user right?
Answer: C. C) Being able to print to a network printer
Printing to a network printer is an object permission, not a system-wide user right. User rights govern logon abilities and system-level privileges like changing the system time or backing up files, which are assigned through local policies.
Q5. How are multiple group policies applied to a Windows client system?
Answer: B. B) Local, Site, Domain, Organizational Unit
Group Policy objects are applied in the order of Local, Site, Domain, and Organizational Unit. Because policies applied last take precedence, Organizational Unit settings overwrite earlier ones. Use the LSDOU mnemonic to easily recall this processing order on the exam.
Q6. How are Windows systems configured to support specific IPSec connections?
Answer: A. A) Using IPSec policies
Windows systems are configured for specific IPsec connections using IPsec policies. These policies determine how traffic is filtered and secured. Watch for distractors like configuration files, as IPsec relies entirely on defined policies.
Q7. What is the name of the authorization token that is given to a user once they have successfully authenticated within a Kerberos controlled network environment?
Answer: D. D) Ticket-granting ticket
A ticket-granting ticket is issued after successful authentication to the Kerberos Key Distribution Center. The user submits this ticket to request service tickets for specific resources. Avoid confusing this with generic access tokens or web session cookies.
Q8. Why is it important for a Windows host to be secured using storage encryption, communication encryption, and multi-factor user authentication?
Answer: B. B) To protect against unauthorized resource access
These controls combine to protect against unauthorized resource access. Encryption secures data at rest and in transit, while multi-factor authentication validates user identities. None of these measures directly prevent malware infections or stop denial of service attacks.
Q9. What is Windows group policy?
Answer: B. B) A collection of registry settings used to enforce security and function
Windows group policy is a collection of registry settings used to enforce security and functionality across systems. It pushes centralized configurations to users and computers. Do not confuse group policy with organizational access guidelines or group membership rules.
Q10. Which system repair and restore option is only available to use once and must be used before the next local logon event?
Answer: A. A) LKGC
Last Known Good Configuration restores the registry to its state after the last successful login, offering a single recovery chance before a new logon overwrites it. System restore points and driver rollbacks can be used repeatedly, regardless of recent login events.
Q11. At what point is it generally recommended that you upgrade a Windows network from a workgroup configuration to a client/server configuration?
Answer: A. A) When there are ten or more systems
Microsoft recommends migrating from a workgroup to a client/server domain model once a network reaches about ten systems due to management overhead. At this scale, decentralized local user accounts become difficult to secure and manage efficiently.
Q12. Why is a system restore point useful when updating device drivers?
Answer: B. B) It creates backups of system components.
Restore points snapshot system components like drivers and registries. Do not rely on them for user data backups or full system recovery after catastrophic loss.
Q13. Which of the following actions will provide the greatest improvement to security when deploying a Windows IIS hosted Web site with a SQL database backend?
Answer: D. D) Encrypt all communications.
Encrypting all communications protects data in transit between the web server and clients. Transport Layer Security prevents eavesdropping and modification of network payloads. Requiring longer passwords helps, but fails to secure the overall transmission channel.
Q14. You are attempting to improve the security of the organization's Windows network when deploying IIS, SQL, and Terminal services. Which of the following is NOT a necessary security measure to implement?
Answer: D. D) Implement a single sign-on (SSO) policy.
Implementing single sign-on to allow internal credentials for external public access is not necessary and introduces risk. Internal credentials should remain separate from public-facing services. Defense in depth, patching, and strict authentication remain critical.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.