GSEC TEST EVALUATION QUESTIONS AND
ANSWERS SET A+
✔✔PC Reset - ✔✔A Windows 8.1 feature that enables you to return your PC back to
the original state it was in when you purchased it or first set it up
✔✔Windows Recovery Environment - ✔✔If a Windows 8 computer fails to start, or if it
crashes repeatedly, a technician can launch this. Which is simply another name given to
Windows PE on a computer with Windows 8 already installed
✔✔PC refresh - ✔✔reinstalls Windows and keeps your personal files and settings
✔✔FAT 32 - ✔✔This file system retains some features of the original FAT while
reducing the maximum size limit of the file cluster so the space on the disk can be more
efficient. < 400 MB and no audit, access controls
✔✔NTFS - ✔✔Often referred to as a "journaling" file system because it keeps track of
transactions performed when working with files and directories.
✔✔ReFS - ✔✔intended for large storage volumes in RAID array does not support
compression
✔✔DACL - ✔✔List of Access Control Entries (ACEs) in Microsoft's NTFS
Each ACE (individual permissions) includes a security identifier (SID) and a permission.
ALWAYS ENFORCED BY THE OS NO MATTER HOW ACCESSED
✔✔ACE - ✔✔Access Control Entry. Identifies a user or group that is granted permission
to a resource. ACEs are contained within a DACL in NTFS. If conflict, DENY gray-
checked: inherited solid-checked: explicit to object C: explicit only inheritance is NOT
mandatory
✔✔CREATOR_OWNER - ✔✔creator is owner, can delete, modify
,admins own objects created during OS install
✔✔Authenticated Users group - ✔✔All user accounts that have been authenticated to
access the system except the Guest account. Compare to anonymous users. Have
read, exe rights.
✔✔AGULP - ✔✔How privileges and permissions should be applied
Accounts (AD, person = acct) Global Groups (domain, RBAC); inner Universal Groups -
forest; inner Local Groups - outer Permissions & Rights (up) inheritance is outer to inner
✔✔Active Directory Global admin - ✔✔in AD, one for each domain in a forest (ALL
POWERFUL IN THAT DOMAIN)
✔✔Active Directory Enterprise admin - ✔✔universal (not global), all powerful group with
full control over every domain in the forest
✔✔CIFS - ✔✔Common Internet File System TCP Port 445, UDP Port 137, 138, 139 -
Dialect of Server Message Block (SMB) protocol. - Enables the sharing of folders/files,
printers and ports over a network.
✔✔SMB - ✔✔Server Message Block Full Control, Change (compare to Modify in
NTFS), Read; $ indicates hidden
✔✔IPC - ✔✔Inter Process Communications- file share that facilitate communication
between processes or threads
✔✔REGEDIT.EXE - ✔✔The ____ tool allows a user to connect to the active registry
database and make changes that are effective immediately.
✔✔Windows Registry - ✔✔keys - folders | values - files | type data | disable remote
registry access
✔✔permission - ✔✔related to a particular object like read access to file
✔✔privilege - ✔✔aka right; not specific to object; general capability, machine specific
(vs permission, 1:1 with object) listed in SAT
✔✔Backup and Restore - ✔✔A Windows utility that allows the user to create a duplicate
copy of all the data on the hard drive and copy it to another storage device.
dangerous - create separate OU group
✔✔Debug Programs - ✔✔only local admin; dangerous (Cain)
, ✔✔BitLocker Drive Encryption - ✔✔Drive encryption software offered in high-end
versionsof Windows. BitLocker requires a special chip to validate hardware status and
to ensure that the computer hasn't been hacked. AES 128 or 256
✔✔FVEK - ✔✔AES 128 or 256 key that encrypts and decrypts all sectors on BitLocker
protected drive
✔✔TPM - ✔✔Trusted Platform Module. This is a hardware chip on the motherboard
included on many newer laptops. A TPM includes a unique RSA asymmetric key, and it
can generate and store other keys used for encryption, decryption, and authentication.
TPM provides full disk encryption.
✔✔Cold boot attack - ✔✔side-channel attack related to removing RAM from computer
while it still contains encryption key, then reading it on a different computer
✔✔UEFI - ✔✔a software layer that replaces the BIOS and sits between the OS and the
system firmware
✔✔GPT - ✔✔GUID partition table is a newer partition type that is used to create drives
larger than 2 TB.
✔✔MBSA - ✔✔Microsoft Baseline Security Analyzer (MBSA) is software developed and
used by Microsoft to check the security of an operating system by assessing missing
security updates and less secure areas of the operating system.
User must be member of the administrators group.
Local and remote machines can be scanned.
✔✔security template - ✔✔What is a collection of configuration settings stored as a text
file with an .inf extension?
✔✔MMC (Microsoft Management Console) - ✔✔enables an administrator to customize
management tools by picking and choosing from a list of snap-ins. Available snap-ins
include Device Manager, Users and Groups, and Computer Management.
✔✔SECEDIT.exe - ✔✔cannot be used over the network; See MMC; MMC.EXE GPO
configurations
✔✔GPMC - ✔✔Group Policy Management console; used to edit GPO on domain
controllers
✔✔SCA - ✔✔Security Configuration and Analysis snap in for GPMC; apply templates to
system (local only)
ANSWERS SET A+
✔✔PC Reset - ✔✔A Windows 8.1 feature that enables you to return your PC back to
the original state it was in when you purchased it or first set it up
✔✔Windows Recovery Environment - ✔✔If a Windows 8 computer fails to start, or if it
crashes repeatedly, a technician can launch this. Which is simply another name given to
Windows PE on a computer with Windows 8 already installed
✔✔PC refresh - ✔✔reinstalls Windows and keeps your personal files and settings
✔✔FAT 32 - ✔✔This file system retains some features of the original FAT while
reducing the maximum size limit of the file cluster so the space on the disk can be more
efficient. < 400 MB and no audit, access controls
✔✔NTFS - ✔✔Often referred to as a "journaling" file system because it keeps track of
transactions performed when working with files and directories.
✔✔ReFS - ✔✔intended for large storage volumes in RAID array does not support
compression
✔✔DACL - ✔✔List of Access Control Entries (ACEs) in Microsoft's NTFS
Each ACE (individual permissions) includes a security identifier (SID) and a permission.
ALWAYS ENFORCED BY THE OS NO MATTER HOW ACCESSED
✔✔ACE - ✔✔Access Control Entry. Identifies a user or group that is granted permission
to a resource. ACEs are contained within a DACL in NTFS. If conflict, DENY gray-
checked: inherited solid-checked: explicit to object C: explicit only inheritance is NOT
mandatory
✔✔CREATOR_OWNER - ✔✔creator is owner, can delete, modify
,admins own objects created during OS install
✔✔Authenticated Users group - ✔✔All user accounts that have been authenticated to
access the system except the Guest account. Compare to anonymous users. Have
read, exe rights.
✔✔AGULP - ✔✔How privileges and permissions should be applied
Accounts (AD, person = acct) Global Groups (domain, RBAC); inner Universal Groups -
forest; inner Local Groups - outer Permissions & Rights (up) inheritance is outer to inner
✔✔Active Directory Global admin - ✔✔in AD, one for each domain in a forest (ALL
POWERFUL IN THAT DOMAIN)
✔✔Active Directory Enterprise admin - ✔✔universal (not global), all powerful group with
full control over every domain in the forest
✔✔CIFS - ✔✔Common Internet File System TCP Port 445, UDP Port 137, 138, 139 -
Dialect of Server Message Block (SMB) protocol. - Enables the sharing of folders/files,
printers and ports over a network.
✔✔SMB - ✔✔Server Message Block Full Control, Change (compare to Modify in
NTFS), Read; $ indicates hidden
✔✔IPC - ✔✔Inter Process Communications- file share that facilitate communication
between processes or threads
✔✔REGEDIT.EXE - ✔✔The ____ tool allows a user to connect to the active registry
database and make changes that are effective immediately.
✔✔Windows Registry - ✔✔keys - folders | values - files | type data | disable remote
registry access
✔✔permission - ✔✔related to a particular object like read access to file
✔✔privilege - ✔✔aka right; not specific to object; general capability, machine specific
(vs permission, 1:1 with object) listed in SAT
✔✔Backup and Restore - ✔✔A Windows utility that allows the user to create a duplicate
copy of all the data on the hard drive and copy it to another storage device.
dangerous - create separate OU group
✔✔Debug Programs - ✔✔only local admin; dangerous (Cain)
, ✔✔BitLocker Drive Encryption - ✔✔Drive encryption software offered in high-end
versionsof Windows. BitLocker requires a special chip to validate hardware status and
to ensure that the computer hasn't been hacked. AES 128 or 256
✔✔FVEK - ✔✔AES 128 or 256 key that encrypts and decrypts all sectors on BitLocker
protected drive
✔✔TPM - ✔✔Trusted Platform Module. This is a hardware chip on the motherboard
included on many newer laptops. A TPM includes a unique RSA asymmetric key, and it
can generate and store other keys used for encryption, decryption, and authentication.
TPM provides full disk encryption.
✔✔Cold boot attack - ✔✔side-channel attack related to removing RAM from computer
while it still contains encryption key, then reading it on a different computer
✔✔UEFI - ✔✔a software layer that replaces the BIOS and sits between the OS and the
system firmware
✔✔GPT - ✔✔GUID partition table is a newer partition type that is used to create drives
larger than 2 TB.
✔✔MBSA - ✔✔Microsoft Baseline Security Analyzer (MBSA) is software developed and
used by Microsoft to check the security of an operating system by assessing missing
security updates and less secure areas of the operating system.
User must be member of the administrators group.
Local and remote machines can be scanned.
✔✔security template - ✔✔What is a collection of configuration settings stored as a text
file with an .inf extension?
✔✔MMC (Microsoft Management Console) - ✔✔enables an administrator to customize
management tools by picking and choosing from a list of snap-ins. Available snap-ins
include Device Manager, Users and Groups, and Computer Management.
✔✔SECEDIT.exe - ✔✔cannot be used over the network; See MMC; MMC.EXE GPO
configurations
✔✔GPMC - ✔✔Group Policy Management console; used to edit GPO on domain
controllers
✔✔SCA - ✔✔Security Configuration and Analysis snap in for GPMC; apply templates to
system (local only)
