GSEC Practice Test 11 — 15 Questions

Question 1

Your organization is adopting the CIS Critical Security Controls to bolster defense. You are currently focused on establishing a secure baseline configuration for all workstation images. Which specific CIS Control should you prioritize to ensure that unauthorized software and unauthorized configuration changes are mitigated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CIS Control 4: Secure Configuration of Enterprise Assets and Software. CIS Control 4, Secure Configuration of Enterprise Assets and Software, focuses on establishing and maintaining security configurations for hardware and software. By mandating a standardized, hardened baseline for all workstations, the organization reduces the attack surface by eliminating unnecessary services and insecure settings. This is a foundational control that directly supports other security measures by ensuring that endpoints are in a known, secure state before they are deployed into the production network environment.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 2: Data Protection

Answer

CIS Control 8: Audit Log Management

Question 2

Which virtualization security concern occurs when an attacker breaks out of the guest operating system to interact directly with the hypervisor?

Accepted Answer

Virtual Machine escape.. A VM escape is a critical vulnerability where an attacker gains access to the host machine from a guest VM. This allows the attacker to compromise other VMs on the same host or the physical hardware itself. Understanding this threat is essential for GSEC professionals, as it represents the highest level of breach in a virtualized infrastructure, requiring rigorous patching and hypervisor hardening.

Answer

Resource exhaustion.

Answer

Snapshot tampering.

Answer

Hypervisor misconfiguration.

Question 3

Which cloud security concept describes the automation of infrastructure deployment using code templates to ensure a consistent, secure, and repeatable environment?

Accepted Answer

Infrastructure as Code.. Infrastructure as Code (IaC) allows for version-controlled, automated, and audited deployment of cloud resources. By treating infrastructure as software, security teams can scan templates for misconfigurations before deployment. This is vital in cloud environments because manual configuration is prone to human error, which is the leading cause of security breaches in modern cloud and virtualization deployments.

Answer

Container Orchestration.

Answer

Serverless Computing.

Answer

Hyper-converged Infrastructure.

Question 4

Refer to the exhibit. Which security risk does the 'HttpOnly' flag specifically mitigate?

Accepted Answer

Cross-Site Scripting (XSS) session theft. The HttpOnly flag is a vital defense against session hijacking via XSS. When this flag is enabled, the browser prevents client-side scripts, such as JavaScript, from accessing the cookie via the document.cookie object. If an attacker successfully executes an XSS attack, they cannot steal the session cookie, thereby preventing them from impersonating the user's session. This is a core defense-in-depth practice for protecting authentication tokens in modern web applications.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) interception

Answer

SQL Injection (SQLi)

Question 5

An IT security team is auditing Windows Update for Business configurations across a multi-site enterprise. Which TWO methods can be utilized by administrators to successfully deploy and enforce these cloud-linked update policies? (Choose TWO)

Accepted Answer

Group Policy Objects (GPOs) applied through Active Directory domains. Windows Update for Business policies can be administered flexibly through traditional enterprise Group Policy or modern cloud-based Mobile Device Management solutions like Microsoft Intune. Providing multiple management pathways enables organizations managing hybrid or fully cloud-native environments to enforce consistent update governance uniformly.

Answer

Manual execution of local PowerShell scripts by end-users with standard privileges

Answer

Direct packet injection via public Wi-Fi access points during routine employee travel

Answer

Editing local security policy templates manually on every individual client workstation

Question 6

An administrator observes that internal users are receiving certificate warnings when accessing a new internal web application. The organization uses an internal Certificate Authority (CA). What is the primary cause of this behavior?

Accepted Answer

The internal Root CA certificate is not installed in the client's local trust store.. Certificate warnings occur when a client cannot establish a chain of trust back to a trusted Root CA. In internal environments, the internal CA certificate must be explicitly imported into the client's trusted root store. Without this root trust, the browser cannot verify the digital signature of the server's certificate, resulting in a trust error. This is a fundamental concept in PKI management for enterprise web security.

Answer

The server certificate has expired, triggering a validity date error in the browser.

Answer

The web server failed to send the intermediate certificate in the handshake process.

Answer

The web application is utilizing an outdated TLS version that browsers no longer support.

Question 7

Refer to the exhibit. What is the effect of the (OI)(CI) flags on the 'Finance_Users' group for the C:\Data directory?

Accepted Answer

Files and subfolders inherit the permissions from the parent.. The (OI) flag stands for Object Inherit, and (CI) stands for Container Inherit. These flags ensure that permissions assigned to the parent folder propagate to all files and subfolders within the directory. This is essential for maintaining consistent access control in environments with deep directory structures. Without these flags, newly created files or subfolders might not inherit the necessary security descriptors, leading to potential access gaps or security policy bypasses.

Answer

Only existing files are modified.

Answer

The permissions are applied to C:\Data only, not children.

Answer

The user cannot delete the folder.

Question 8

During a web application audit, you determine that the server is vulnerable to a 'Slowloris' attack. What is the most likely symptom of this attack on the web server?

Accepted Answer

Exhaustion of available connection slots. Slowloris is a low-bandwidth Denial-of-Service (DoS) attack that keeps connections open by sending partial HTTP requests. By never completing the request headers, the server's connection pool becomes exhausted, leaving no threads available to handle legitimate users. This is a classic example of an application-layer DoS attack, which highlights the importance of configuring proper timeout settings and resource limits on web servers like Apache or Nginx.

Answer

Complete server crash due to memory corruption

Answer

Database downtime caused by excessive query volume

Answer

Unauthorized access to the application root directory

Question 9

A user reports they cannot open a downloaded application because macOS states the developer cannot be verified. Which security feature is preventing the execution of this application?

Accepted Answer

Gatekeeper. Gatekeeper is the security technology that verifies that software is from a trusted developer and has not been tampered with. By requiring code signing and notarization, Gatekeeper helps prevent the execution of malicious software. For a GSEC professional, recognizing Gatekeeper's role is key to troubleshooting deployment issues while maintaining the organization's security policy, as it is the first line of defense against unauthorized applications running on the user's desktop.

Answer

XProtect

Answer

System Integrity Protection

Answer

FileVault 2

Question 10

An enterprise network administrator needs to manage Windows 10 feature updates across a heterogeneous fleet containing both Enterprise and Professional editions. Which deployment methodology natively supports setting a target release version to freeze clients on a specific version like 21H2 while blocking automatic upgrades to later versions?

Accepted Answer

Windows Update for Business configured via Group Policy to specify a target release version. Setting a target release version through Group Policy or Mobile Device Management allows administrators to freeze workstations on a specific Windows 10 feature update, such as 21H2. This control prevents automatic upgrades to newer major OS versions, ensuring mission-critical line-of-business applications remain compatible without requiring immediate manual intervention across every individual endpoint device.

Answer

Windows Server Update Services automatic approval rules targeting all newly released operating system updates

Answer

Consumer Windows Update settings modified through local registry edits on each individual workstation

Answer

Delivery Optimization peer-to-peer distribution bandwidth throttling applied via Local Group Policy

Question 11

A security administrator is troubleshooting an enterprise client that repeatedly fails to complete a major Windows feature upgrade, automatically triggering a rollback. Which built-in command-line utility should the administrator use to examine detailed migration logs, error codes, and rollback triggers?

Accepted Answer

SetupDiag.exe to automatically parse update setup logs and identify failure reasons. SetupDiag is a specialized diagnostic tool designed to analyze Windows setup logs and pinpoint the exact root cause of a failed feature update or rollback. Reviewing these logs allows security and systems engineers to rapidly identify blocking drivers, incompatible applications, or registry corruption preventing successful Windows as a Service upgrades.

Answer

SFC.exe /scannow to inspect operating system file integrity

Answer

DISM.exe /Online /Cleanup-Image /RestoreHealth to repair component stores

Answer

GPResult.exe /h report.html to generate a comprehensive group policy diagnostic report

Question 12

Refer to the exhibit. What is the current configuration state for auditing 'Account Logon' events based on the provided output?

Accepted Answer

Both success and failure are being audited. The output indicates that the 'Account Logon' category is configured to audit both success and failure for credential validation. Auditing this is essential because it captures domain-wide authentication attempts occurring on the domain controller. This visibility is vital for identifying brute-force attacks or anomalous login behavior, providing a foundation for effective incident response and forensic analysis within the Windows infrastructure.

Answer

Only failure events are being audited

Answer

Auditing is completely disabled for this category

Answer

Only success events are being audited

Question 13

An enterprise development team is designing a Kubernetes cluster deployment where application containers frequently interact with cloud provider APIs. To minimize security blast radius, which architectural practice provides the most effective credential isolation per pod?

Accepted Answer

Implement service account token volume projection with short-lived auditable tokens scoped to individual application requirements.. Service account token volume projection utilizes short-lived tokens cryptographically signed by the cluster, mounting them securely into specific pods with restricted audiences. This approach replaces static long-lived credentials stored in environment variables or generic secrets, significantly reducing lateral movement risks if an application is compromised.

Answer

Store cloud provider credentials in base64-encoded Kubernetes Secret objects and mount them as environment variables.

Answer

Configure cluster-wide IAM roles on the underlying worker nodes and allow all hosted pods to inherit administrative permissions.

Answer

Embed the static cloud API keys directly into the container base image layers to ensure consistency across deployments.

Question 14

Which TWO of the following are primary functions of a Public Key Infrastructure (PKI)?

Accepted Answer

Issuance of digital certificates to verify identity.. PKI is vital for managing the lifecycle of digital certificates, ensuring trust in identity. By providing mechanisms for issuance and revocation, PKI allows entities to communicate securely without pre-existing trust. Understanding these functions is essential for GSEC professionals to manage authentication and secure communication channels effectively within an enterprise architecture, preventing the use of expired or fraudulent credentials that could be exploited by malicious actors during network sessions.

Answer

Centralized distribution of symmetric keys.

Answer

Hardware-level encryption for disk storage.

Answer

Real-time traffic flow monitoring and alerting.

Question 15

An administrator needs to restrict sensitive file access on a Windows Server 2022 environment while ensuring that users only access resources based on their job titles. Which Windows technology should be implemented to leverage Dynamic Access Control (DAC) for this requirement?

Accepted Answer

Configure Central Access Policies. Dynamic Access Control allows administrators to apply access policies based on user claims and resource properties rather than traditional security groups alone. By integrating Active Directory claims and resource attributes, you can automate permissions, which significantly reduces the administrative overhead of managing thousands of individual NTFS permissions. This is critical for maintaining the principle of least privilege in scaling enterprise environments where group-based memberships become too complex to manage effectively.

Answer

Implement Kerberos Constrained Delegation

Answer

Apply AppLocker Software Restriction Policies

Answer

Utilize Encrypting File System (EFS)