Unit 2: Windows Security, User Management, and Networking - Practice Quiz

1 Which type of Windows account normally has permission to install software and change system-wide settings?

2 What is the main purpose of placing Windows users into groups?

3 Which authentication method uses something the user knows?

4 What does multi-factor authentication require?

5 What does an access control list (ACL) specify?

6 Which NTFS permission allows a user to view a file without changing it?

7 Which built-in Windows tool helps detect and remove malicious software?

8 What is the primary purpose of User Account Control (UAC)?

9 What does Windows Firewall primarily control?

10 Which Windows command displays the computer's current IP configuration?

11 What is the main function of DNS?

12 Which network service automatically assigns IP configuration to client devices?

13 Which protocol is commonly used by Windows for network file and printer sharing?

14 What is a shared folder?

15 Which Windows technology provides a graphical session on a remote computer?

16 What is PsExec commonly used to do?

17 Which Windows tool is used to view and manage system services?

18 Which Windows utility is used to examine application, security, and system logs?

19 What can a basic logon audit policy record?

20 Which native Windows command displays the processes currently running on the system?

21 A technician needs to let a user install approved desktop applications and change system-wide settings without granting unrestricted control over the computer. Which local group is the most appropriate starting point?

22 An administrator wants to disable a former employee's local account while preserving its profile and group memberships for an investigation. Which command best meets this requirement?

23 A company wants domain users to sign in without sending reusable passwords across the network and to use tickets for access to services. Which authentication protocol best matches this requirement?

24 A laptop uses Windows Hello facial recognition. Where is the credential normally validated when the user signs in?

25 A user has NTFS Read permission through one group and NTFS Modify permission through another group. No deny entries apply. What is the user's effective NTFS permission?

26 A folder grants a user Modify, but an inherited ACL entry explicitly denies that user Write. What is the expected effective result?

27 An unsigned application attempts to make a system-wide change while a standard user is signed in. What does User Account Control normally do?

28 A server must accept inbound HTTPS traffic while continuing to block unsolicited traffic on other ports. Which Windows Firewall change is most appropriate?

29 A workstation receives the address 169.254.18.40 after startup and cannot reach other subnets. Which failure is the most likely cause?

30 A user can connect to a server by IP address but not by its hostname. Which component should be investigated first?

31 A user accesses \\fileserver\reports from File Explorer. Which protocol primarily provides this Windows file-sharing connection?

32 A network share grants a group Read, while the folder's NTFS ACL grants the same group Modify. What can group members normally do when accessing the folder through the share?

33 An administrator needs an interactive graphical session on a remote Windows server. Which tool is designed for this purpose?

34 An administrator runs psexec \\PC12 ipconfig /all. What is the intended result?

35 An administrator must configure one console that displays Event Viewer, Services, and Local Users and Groups. Which tool supports this arrangement?

36 A service must start automatically after other automatic services have initialized. Which startup type should be selected in Services.msc?

37 During a suspected password-guessing attack, an analyst wants to identify repeated failed Windows sign-in attempts. Which Security log event ID is most relevant?

38 A security team wants failed sign-in attempts to appear in the Security event log. Which audit setting should be enabled?

39 A maintenance script must run every night even when no user is signed in. Which Task Scheduler configuration is most appropriate?

40 A suspicious program launches whenever a particular user signs in, but no scheduled task or service is responsible. Which location should an analyst inspect first?

41 A local user account named Analyst is deleted and recreated with the same name. Files whose ACLs granted access only to the original account now display an unresolved SID, and the recreated account cannot open them. What best explains this behavior?

42 A domain user accesses an SMB server by entering \\10.20.30.40\Data. Authentication falls back to NTLM, although Kerberos works when the server's hostname is used. Which change most directly restores Kerberos authentication?

43 An administrator is the owner of an NTFS folder but has no Allow ACE granting access to it. No policy explicitly denies changing permissions. Which recovery action is normally available because of ownership?

44 A folder with restrictive NTFS permissions is moved from C:\Restricted to C:\Public on the same NTFS volume. The destination normally grants broader inherited access. What happens to the moved folder's permissions by default?

45 A user in the local Administrators group opens a normal, non-elevated PowerShell window under UAC Admin Approval Mode. Why can administrative commands still fail with access denied?

46 Windows Firewall has an enabled inbound Allow rule for TCP port 445 and an enabled inbound Block rule that also matches the same connection. Both apply to the active profile. What is the expected result?

47 A DHCP-configured workstation shows IPv4 address 169.254.84.12, mask 255.255.0.0, and no default gateway. Other computers on the LAN have valid leases. Which diagnosis is most consistent with this configuration?

48 On a workstation, ping fileserver resolves to 10.0.0.25, while nslookup fileserver returns 10.0.0.50 from the configured DNS server. Connectivity to both addresses is available. Which local condition best explains the discrepancy?

49 A modern Windows client can reach a file server by IP address. TCP 445 is allowed, but UDP 137, UDP 138, and TCP 139 are blocked. DNS resolves the server correctly. Which outcome is most likely?

50 A user accesses \\Server\Reports over SMB. The share permission grants Change, while the NTFS ACL grants only Read & execute. What effective access does the user receive through the share?

51 An administrator must execute a command remotely. TCP 3389 is blocked, but TCP 445 is open; ADMIN$ is accessible, and the administrator can create services on the target. Which tool and mechanism fit these conditions?

52 A service configured with startup type Automatic repeatedly crashes after launch. An administrator changes it to Automatic (Delayed Start), but it still remains stopped after crashing. Which Services configuration directly addresses this behavior?

53 A domain has a GPO linked at the domain level and another linked to the workstation's OU. Both configure the same setting, neither link is enforced, and inheritance is not blocked. Which setting normally wins?

54 During an incident, Security log event 4624 records Logon Type 3, followed by events showing access to an SMB share. What does Logon Type 3 indicate?

55 Security event 4688 events are present, but their process command-line fields are empty. Process creation auditing is already enabled. Which additional configuration is required to record command-line arguments?

56 An administrator enables the Audit File System subcategory for both success and failure, but access to D:\Sensitive\plan.docx produces no file-access audit events. What is the most likely missing configuration?

57 A scheduled task configured to run whether or not its user is logged on successfully launches an application, but no window appears on that user's desktop. Task history reports success. What best explains this result?

58 An administrator creates an entry under HKLM\Software\Microsoft\Windows\CurrentVersion\Run. A standard user then signs in. Under which security context does the startup program normally execute?

59 During local investigation, netstat -ano shows an established connection owned by PID 4120. Which native command most directly identifies the process image associated with that PID?

60 A user has just been added to a privileged group, but an already-running command prompt does not show the group as enabled in whoami /groups. The directory change is confirmed. What is the most likely corrective action?