GSEC Practice Exam: Windows Security Domain

Correct Answer: A

Explanation: Disabling the Guest account and renaming the Administrator account are effective measures to prevent unauthorized access, as it reduces the risk of brute-force attacks on default accounts. BitLocker encryption (B) protects data at rest but does not directly prevent unauthorized access to system files. Preventing access to the Command Prompt (C) limits user actions but does not directly secure sensitive files. Setting NTFS permissions for the Everyone group (D) weakens security by allowing broad access.

Correct Answer: A

Explanation: BitLocker encrypts the entire drive, ensuring that all data is protected and inaccessible without proper authentication, even if the physical device is stolen. Option B is incorrect because file-level encryption may leave some data unprotected. Option C is incorrect because strong passwords, while important, do not protect data if the drive is physically accessed. Option D is incorrect because tracking software does not protect the data itself from unauthorized access.

Correct Answer: D

Explanation: A cloud-based endpoint protection solution offers real-time protection and can be managed centrally, providing a comprehensive approach to malware protection. Option A is incorrect because while antivirus software is important, it may not provide real-time protection and relies on scheduled scans. Option B is incorrect because Windows Defender, while useful, may not be sufficient alone for enterprise-level protection. Option C is incorrect because restricting software installations does not directly protect against malware that may already be present or enter through other vectors.

Correct Answer: B

Explanation: B is correct because Event ID 4625 indicates a failed logon attempt, which is useful for identifying unauthorized access attempts. A is incorrect because a successful logon is recorded with Event ID 4624. C and D are incorrect because user account creation and deletion are logged with different event IDs, such as 4720 and 4726, respectively.

Correct Answer: D

Explanation: D is correct because Microsoft Baseline Security Analyzer (MBSA) is a tool specifically designed to assess missing security updates and vulnerabilities on Windows systems. A is incorrect because Windows Defender is an antivirus program, not a patch management tool. B is incorrect because Event Viewer is used for viewing log files, not for identifying missing patches. C is incorrect because Windows Update installs patches but does not provide a comprehensive report of all missing security updates.

Correct Answer: C

Explanation: Group Policy settings for password length apply only to new passwords, not existing ones, which is why some users may still have shorter passwords. Option A is incorrect because linking issues would prevent any settings from applying. Option B is incorrect because password policies apply even if users haven't logged off. Option D is unrelated to password length enforcement.

Correct Answer: B

Explanation: Disabling the inactive accounts and monitoring for access attempts is the most secure approach as it prevents unauthorized access while allowing for potential reactivation if needed. Deleting the accounts immediately could result in loss of historical data or access issues if the accounts are needed later. Resetting passwords to a default value is insecure and could lead to unauthorized access. Moving accounts to a separate OU does not prevent unauthorized access.

Correct Answer: B

Explanation: The 'Account Lockout Policy' can be configured to automatically lock accounts after a specific number of failed login attempts, which indirectly helps to block IP addresses through account lockout. Option A, 'Windows Defender Firewall', and Option C, 'Windows Firewall with Advanced Security', are used for managing network traffic but do not automatically block IPs based on login attempts. Option D, 'Security Log Monitoring', involves reviewing logs for suspicious activity but does not provide automated blocking.

Correct Answer: A

Explanation: Option A is correct because blocking the IP address at the firewall immediately stops the attack from the external source. Option B is a good long-term strategy but does not address the immediate threat. Option C helps prevent account compromise but does not stop the ongoing attempts. Option D is irrelevant to the specific issue of login attempts.

Correct Answer: A

Explanation: The 'net user' command is used to list all user accounts on a Windows machine, making it useful for identifying unauthorized accounts. Option B, 'ipconfig /all', displays network configuration details. Option C, 'tasklist', shows running processes. Option D, 'netstat -a', displays active network connections, not user accounts.