GSEC Practice Test 10 — 10 Questions

Question 1

An organization is migrating to a cloud environment and must ensure that data remains encrypted while in use by applications. Which technology should the security team implement to achieve this?

Accepted Answer

Homomorphic Encryption. Homomorphic encryption is a sophisticated cryptographic technique that allows computations to be performed on encrypted data without first needing to decrypt it. This ensures that the data is never exposed in cleartext within the application's memory or on the cloud provider's host, effectively providing security for data-in-use. This is a powerful, though performance-intensive, solution for highly regulated industries like finance or healthcare that require data protection even during processing in untrusted environments.

Answer

Transport Layer Security (TLS)

Answer

Full Disk Encryption (FDE)

Answer

Database Transparent Data Encryption

Question 2

Which password management practice best minimizes the impact of a credential stuffing attack?

Accepted Answer

Enforcing unique passwords per service. Credential stuffing relies on users reusing the same passwords across multiple services. By enforcing unique, complex passwords for every single account, users ensure that a compromise at one service does not lead to a cascade of compromises elsewhere. This is the single most effective defense against automated attacks that attempt to use leaked database dumps to gain unauthorized access to other unrelated accounts held by the same user.

Answer

Mandating password changes every 30 days

Answer

Requiring a minimum password length of 8 characters

Answer

Disabling account lockout after failed attempts

Question 3

Why does the inclusion of detective controls improve a defense in depth strategy?

Accepted Answer

They provide visibility into successful bypasses of preventive controls.. Preventive controls are not always effective against every threat; therefore, detective controls are necessary to identify breaches that successfully penetrate the perimeter. By monitoring for indicators of compromise, security teams can respond to incidents in progress. This reduces the dwell time of an attacker, preventing a minor initial compromise from escalating into a major data exfiltration event. Detective controls effectively close the loop between prevention and response in a defense in depth model.

Answer

They automatically block all malicious traffic before it reaches the network.

Answer

They remove the need for regular vulnerability assessments.

Answer

They ensure that all user actions are strictly restricted by policy.

Question 4

An organization needs to encrypt a database of PII. The requirements state that the encryption must be reversible by authorized staff and provide data integrity. Which implementation should the security engineer recommend?

Accepted Answer

Implement AES-256 in GCM mode.. Using AES-256 in GCM mode provides both confidentiality and authenticity. Symmetric encryption is appropriate for database encryption where authorized entities hold the decryption keys. GCM mode is preferred because it acts as an Authenticated Encryption with Associated Data (AEAD) algorithm, preventing unauthorized modification of the ciphertext. This is critical for database security, where verifying that data has not been tampered with is as important as preventing unauthorized disclosure of the stored information.

Answer

Use SHA-256 hashing for all database fields.

Answer

Use RSA-4096 for encrypting large datasets.

Answer

Apply XOR-based encryption with a static global key.

Question 5

Refer to the exhibit. An analyst observes this command execution on a workstation. Which immediate action represents the most effective containment strategy?

Accepted Answer

Isolate the workstation from the network. The exhibit shows base64 encoded PowerShell execution, commonly used for malicious script downloads. Immediate containment requires isolating the endpoint from the network to prevent further outbound connections to C2 servers. By severing the network connection, responders prevent the attacker from executing additional instructions, exfiltrating data, or establishing secondary persistence mechanisms while the forensic investigation proceeds offline.

Answer

Reboot the workstation immediately

Answer

Delete the PowerShell process

Answer

Update the antivirus definitions

Question 6

Refer to the exhibit. Which type of attack is being mitigated by the application framework, and what incident phase should this alert trigger?

Accepted Answer

Cross-Site Scripting; Identification. The exhibit shows a Cross-Site Scripting (XSS) attempt blocked by the application's input validation layer. This should trigger the Identification phase of the incident response lifecycle. Even though the attack was blocked, it indicates an attacker is actively probing the application for vulnerabilities. Early detection allows the team to block the source IP and verify if other, more successful, attempts were made against the infrastructure.

Answer

SQL Injection; Containment

Answer

Cross-Site Request Forgery; Eradication

Answer

Buffer Overflow; Preparation

Question 7

An organization is deploying an automated incident response tool. Which requirement is most important to ensure the tool's effectiveness during a high-severity security incident?

Accepted Answer

Pre-defined and validated response playbooks. Automated tools must have clear, pre-defined playbooks. If automation is used without strict, validated logic, it may trigger unintended consequences, such as locking out critical production services or deleting valid data during an active attack. Effective automation requires accurate context to prevent the incident response tool from causing more operational downtime than the actual security threat it is designed to mitigate during a crisis.

Answer

Integration with the social media monitoring platform

Answer

Integration with external threat intelligence feeds

Answer

Unlimited cloud storage for log retention

Question 8

An analyst notices that the SIEM is triggering an excessive number of 'False Positive' alerts related to failed login attempts. Which strategy is most effective for reducing these alerts without compromising security posture?

Accepted Answer

Implement a threshold-based correlation rule to alert only after five failed attempts within one minute.. Tuning the SIEM to filter noise is critical for preventing analyst fatigue and ensuring high-fidelity alerts remain visible. By creating suppression rules for known service account behavior or implementing threshold-based alerts, analysts can focus on genuine threats. This process is essential for maintaining a healthy SIEM environment where security teams can respond efficiently to legitimate incidents rather than chasing benign log noise generated by standard system maintenance tasks.

Answer

Disable all failed login logging on domain controllers to save SIEM storage.

Answer

Increase the severity level of all login failure logs to 'Critical'.

Answer

Archive all failed login logs to cold storage immediately upon ingestion.

Question 9

Which security control is most effective at preventing the execution of unauthorized or malicious software by enforcing a 'deny-by-default' policy on a workstation?

Accepted Answer

Application Whitelisting (e.g., AppLocker or WDAC).. Application whitelisting (or Application Control) prevents any program from running unless it is explicitly permitted by a defined policy. This is vastly superior to blacklisting, which can only block known threats. In a professional environment, this controls the execution environment, significantly reducing the attack surface by ensuring that only vetted and approved binaries, scripts, and installers can run, effectively mitigating zero-day threats and unauthorized utility usage.

Answer

Endpoint Detection and Response (EDR) agents.

Answer

Next-Generation Antivirus (NGAV) with behavioral analysis.

Answer

Host-based Intrusion Prevention System (HIPS).

Question 10

An administrator observes a series of SYN packets originating from an internal workstation targeting random ports on various external IP addresses. The traffic is not resulting in established TCP connections. What is the most likely purpose of this network behavior?

Accepted Answer

The host is performing TCP half-open reconnaissance.. The behavior described is characteristic of a TCP port scan. By sending SYN packets without completing the three-way handshake, the attacker identifies open services while attempting to minimize detection. Understanding reconnaissance techniques is vital for network defense, as these scans often precede targeted exploitation attempts. Security analysts must identify such patterns early to implement egress filtering or isolate the compromised host before it initiates a more severe attack.

Answer

The workstation is performing a standard DNS resolution process.

Answer

The system is initiating a legitimate peer-to-peer file transfer.

Answer

The network interface is experiencing a broadcast storm.