GSEC Practice Test 12 — 15 Questions

Question 1

During an internal network security audit, an engineer discovers that workstations on the human resources VLAN can directly communicate with sensitive database servers on the finance VLAN without passing through a filtering device. Which foundational architectural control is missing from this environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforcing inter-VLAN access control lists or deploying an internal firewall to inspect and restrict traffic between functional zones.. Micro-segmentation and internal routing firewalls are essential for enforcing least privilege communication between distinct functional business units. When VLANs reside on a core router or multi-layer switch without inter-VLAN access control lists, traffic flows freely between security zones. Implementing internal firewalls between these segments ensures that human resources workstations only access authorized HR applications.

Answer

Deploying a high-availability server load balancer in front of the human resources workstation subnet.

Answer

Upgrading all edge routers to support Border Gateway Protocol with strict cryptographic route validation.

Answer

Replacing all traditional dynamic host configuration protocol scopes with static IP address assignments.

Question 2

A security engineer is segmenting a data center so that contractors who maintain HVAC systems cannot initiate connections into the server VLAN, but the internal monitoring platform must still reach the contractor subnet to poll building-management sensors. The chosen design uses a stateful firewall between the two zones with the contractor zone as the untrusted side. Which configuration best enforces the required traffic direction while preserving monitoring?

Accepted Answer

Configure the firewall so the monitoring platform initiates sessions into the contractor zone, allowing only established, return traffic back to the monitoring platform.. The requirement is directional control between zones, so a stateful firewall must see the trusted monitoring platform initiate the session and then allow only the return traffic for that established flow. Contractors are thereby unable to originate connections into the server VLAN, while polling of building-management sensors continues. Stateless ACLs and private addressing do not provide this session-aware, one-way enforcement.

Answer

Place both zones behind a single perimeter firewall and permit all inter-zone traffic, relying on the contractor VLAN's private IP addressing to prevent reachability.

Answer

Apply an ACL on the contractor zone's router interface that permits only the monitoring platform's IP to the sensor subnet and denies all other traffic in both directions.

Answer

Configure a stateful firewall rule permitting the contractor subnet to the sensor subnet on the management ports, and add an implicit deny at the end of the rule base.

Question 3

A security engineer is designing an internal Public Key Infrastructure (PKI) and needs to issue a subordinate certificate authority (sub-CA) certificate. To prevent this sub-CA from accidentally or maliciously issuing certificates for unauthorized domains, what specific X.509 extension must be correctly configured?

Accepted Answer

Name Constraints extension configured with explicit permitted and excluded subtree subdirectories for domain namespaces.. Name Constraints restrict the namespace within which all subject names in certificates issued by the CA must reside. This crucial X.509 extension prevents a compromised subordinate CA from generating trusted certificates for domains outside its permitted organizational scope, thereby containing blast radius in enterprise PKI hierarchies.

Answer

Key Usage extension populated solely with Digital Signature, Non-Repudiation, and Key Encipherment flags.

Answer

Authority Information Access extension pointing directly to the organization's primary online OCSP responder.

Answer

Extended Key Usage extension restricted strictly to TLS Web Server Authentication and Code Signing.

Question 4

A retail company is reviewing its defense in depth strategy after a breach where an attacker used stolen credentials to access a database server. The investigation showed that the server had no host-based logging, and database activity was not monitored. Which TWO controls should be added to improve detection of similar future attacks? (Choose two.)

Accepted Answer

Deploying host-based intrusion detection system (HIDS) agents on database servers. The breach exploited stolen credentials to access a database server, and the gaps were lack of host-based logging and database activity monitoring. HIDS agents provide host-level visibility into attacker actions, while DAM logs and alerts on suspicious database queries. Together they create detective controls that would likely have identified the unauthorized access. The other options are preventive or confidentiality controls that do not address the detection gap.

Answer

Enforcing a password complexity policy for all database accounts

Answer

Implementing full-disk encryption on the database server

Answer

Configuring a next-generation firewall to block outbound traffic from the database server

Question 5

A hospital's IT team is designing layered defenses for its electronic health record (EHR) system. They already have perimeter firewalls, network intrusion prevention, and endpoint antivirus. The CISO wants to add a control that detects unauthorized modification of EHR database records and alerts the security team in near real time. Which control best fills this gap while preserving defense in depth?

Accepted Answer

File integrity monitoring (FIM) with cryptographic hashing on the EHR database files. The scenario requires a detective control that specifically identifies unauthorized changes to EHR database records. File integrity monitoring with cryptographic hashing provides exactly that by comparing current file hashes to a trusted baseline and alerting on mismatch. The other options either duplicate existing preventive controls or provide logging without integrity detection, leaving the data-layer gap unaddressed.

Answer

Implementing full-disk encryption on the EHR database servers

Answer

Configuring syslog forwarding from the EHR servers to a central SIEM

Answer

Deploying an additional host-based firewall on the EHR application servers

Question 6

A security administrator is reviewing the password policy for a high-security environment. The policy requires the use of a hardware token that generates a one-time password (OTP) based on a secret key and the current time. The administrator notices that some tokens are failing authentication because the server and tokens are not time-synchronized. Which of the following should the administrator implement to ensure the OTPs are validated correctly?

Accepted Answer

Configure a time drift window on the authentication server.. Time-based OTP tokens require the server and token to have closely synchronized clocks. When tokens drift, the server can accept OTPs from adjacent time steps by configuring a time drift window. This is a standard feature in TOTP implementations and directly addresses the authentication failures without replacing hardware or altering token generation.

Answer

Enable NTP synchronization on the authentication server only.

Answer

Switch from time-based to event-based OTP tokens.

Answer

Increase the OTP length to 8 digits.

Question 7

A financial services firm is deploying a new high-security network segment for trading systems. The security team wants to prevent unauthorized devices from communicating on the segment even if they physically connect to an access switch port. The chosen solution must authenticate the device before any network access is granted and must integrate with the existing RADIUS server. Which technology should be implemented?

Accepted Answer

802.1X with EAP-TLS and RADIUS on the access switch ports.. 802.1X with EAP-TLS enforces authentication at the switch port before any network access is granted. The switch acts as an authenticator, passing credentials to the RADIUS server. Until the supplicant presents a valid certificate, only EAPoL traffic is allowed, preventing unauthorized devices from communicating. This integrates with the existing RADIUS infrastructure and provides strong, certificate-based identity verification suitable for high-security trading systems.

Answer

Private VLANs (PVLANs) with isolated ports for each trading system.

Answer

MACsec (802.1AE) encryption on all switch uplinks.

Answer

Port security with sticky MAC addresses on each access port.

Question 8

A security analyst is reviewing a legacy application that uses RSA for digital signatures. The application generates a 1024-bit RSA key pair and signs messages using SHA-1. The analyst must recommend an upgrade that maintains the same algorithm family but meets current security standards. Which change should be recommended?

Accepted Answer

Increase the RSA key size to 2048 bits and replace SHA-1 with SHA-256.. To meet current security standards while preserving the RSA algorithm family, the analyst should recommend increasing the RSA key size to 2048 bits and replacing SHA-1 with SHA-256. This addresses both the weak key length and the deprecated hash function, providing a secure and compliant digital signature solution without changing the underlying public-key algorithm.

Answer

Keep the 1024-bit RSA key but replace SHA-1 with SHA-3.

Answer

Replace RSA with HMAC-SHA256 for signing.

Answer

Switch to Elliptic Curve Digital Signature Algorithm (ECDSA) with P-256 and SHA-256.

Question 9

A software vendor distributes signed firmware updates to customers. During an incident review, an analyst discovers that an attacker who obtained the vendor's code-signing private key was able to produce updates that passed signature verification on customer devices. The vendor wants to redesign the signing process so that compromise of a single signing key no longer allows an attacker to forge valid updates. Which change best achieves this goal?

Accepted Answer

Require each update to be signed by a threshold of multiple independent keys.. Threshold signing distributes the signing capability across multiple independent keys so that no single compromised key can produce a valid signature. Increasing key size, changing to ECDSA, or adding a transparency log all leave a single key capable of forging updates. Only requiring a quorum of keys changes the trust model so that one stolen key is insufficient.

Answer

Increase the RSA key size from 2048 to 4096 bits.

Answer

Publish the firmware hashes to a public transparency log.

Answer

Switch the signature algorithm from RSA to ECDSA with P-256.

Question 10

A Linux server has the setuid bit set on /usr/bin/passwd. A security engineer notices that a custom binary /opt/tools/backup_tool also has the setuid bit set and is owned by root. The engineer wants to determine whether executing backup_tool will run with root privileges regardless of which user invokes it. Which of the following is the most accurate statement about how the setuid bit affects process credentials on Linux?

Accepted Answer

The process runs with the effective UID of the file owner, but the real UID remains that of the invoking user, and the saved set-user-ID is set to the file owner's UID.. Executing a setuid binary causes the kernel to set the process's effective UID to the file owner's UID while preserving the real UID of the invoking user. The saved set-user-ID is also set to the file owner's UID, which lets the program temporarily drop and reacquire elevated privileges. This mechanism is why setuid root binaries are high-value targets: any vulnerability in backup_tool could yield root-level access to an unprivileged attacker.

Answer

The process runs with the effective UID of the file owner only if the binary is also executable by the invoking user; otherwise the kernel silently falls back to the invoking user's UID.

Answer

The setuid bit is ignored on Linux unless the filesystem is mounted with the suid option, so the behavior depends entirely on the mount options of the filesystem holding the binary.

Answer

The process runs with the real UID, effective UID, and saved set-user-ID all set to the file owner's UID, so the invoking user's identity is completely lost to the kernel.

Question 11

A security analyst is reviewing a compromised Linux web server. The attacker escalated to root and then ran a script that unlinked the file /var/log/auth.log to hide their tracks. The analyst runs `lsof | grep auth.log` and sees the file is still open by the rsyslogd process, but `ls /var/log/auth.log` reports that the file does not exist. Which of the following best explains why the file content is still accessible through the open file descriptor?

Accepted Answer

The Linux kernel maintains the inode and data blocks until the last open file descriptor referencing the inode is closed, even after the directory entry is removed.. When a file is unlinked on Linux, the directory entry is removed but the inode persists as long as a process holds an open file descriptor. rsyslogd keeps auth.log open for writing, so the kernel cannot free the inode or data blocks. The analyst can recover the contents via /proc//fd/, even though the pathname no longer resolves. Restarting rsyslogd would close the descriptor and finally reclaim the inode.

Answer

The rsyslogd process has the file memory-mapped with mmap, so the page cache keeps a copy that ls can still resolve by inode lookup.

Answer

The file was moved to a hidden directory by the attacker, and lsof is resolving the path from the process's current working directory rather than the real inode.

Answer

The ext4 filesystem journals file deletions, and lsof reads the journal to reconstruct the file contents until the journal is overwritten by subsequent writes.

Question 12

A government agency uses a defense in depth architecture with strict perimeter firewalls, network segmentation, and endpoint protection. During a red team exercise, attackers gained initial access via a phishing email and then moved laterally by exploiting a misconfigured internal server. The agency wants to improve its ability to detect and respond to such lateral movement. Which control would be most effective to add?

Accepted Answer

Deploying network-based intrusion detection system (NIDS) sensors on internal network segments. Lateral movement occurs inside the network after initial compromise, so detection requires visibility into internal traffic. NIDS sensors on internal segments can identify exploit attempts, scanning, and unusual communication patterns between hosts. Perimeter and email controls address initial access, while application whitelisting is host-focused and may not detect network-based movement. Internal NIDS fills the specific gap highlighted by the red team exercise.

Answer

Enforcing application whitelisting on all endpoints

Answer

Increasing the perimeter firewall rule set to block more inbound ports

Answer

Implementing stricter email filtering to prevent phishing emails

Question 13

A small financial firm has a flat network with no internal segmentation. The security team wants to apply defense in depth to limit the blast radius of a compromised workstation. Which action best aligns with that goal?

Accepted Answer

Segmenting the network into VLANs based on function and applying ACLs between them. To limit the blast radius of a compromised workstation, the firm needs internal segmentation that restricts lateral movement. VLANs with inter-VLAN ACLs create logical boundaries so that a compromised host cannot freely access other segments. This is a classic defense-in-depth control that adds an internal layer beyond perimeter defenses. Authentication and WAF controls address different threats and do not contain an internal compromise.

Answer

Implementing 802.1X port-based network access control on all switch ports

Answer

Deploying a web application firewall (WAF) in front of the firm's public website

Answer

Enforcing strong password policies and multi-factor authentication for all users

Question 14

A financial services firm separates its cardholder data environment from the corporate network using internal VLANs and a next-generation firewall. The security architect wants to add a detective control that will identify malicious traffic that successfully crosses between segments. Which solution best fits this requirement?

Accepted Answer

Install a network intrusion detection system (NIDS) with a span port monitoring traffic between the VLANs.. The architect needs visibility into traffic that crosses the segmentation boundary, which is a detective control function. A network intrusion detection system monitoring a SPAN port sees copies of packets traversing the inter-VLAN link and can alert on malicious patterns. WAFs, 802.1X, and private VLANs either focus on web traffic or enforce preventive access restrictions, none of which detect successful cross-segment intrusions.

Answer

Configure private VLANs to prevent hosts within the cardholder data environment from communicating with each other.

Answer

Deploy a web application firewall (WAF) in front of the cardholder data environment.

Answer

Enable 802.1X port-based network access control on all switch ports in both VLANs.

Question 15

A software development company wants to protect its source code repositories from insider threats and external attackers. The company already uses network segmentation and endpoint detection. The security team proposes adding a control that requires two distinct factors before developers can access repositories, even from within the corporate network. Which control best meets this requirement?

Accepted Answer

Implementing multi-factor authentication (MFA) for repository access. The requirement is to require two distinct authentication factors before granting repository access, even from inside the corporate network. Multi-factor authentication is the only option that provides this by combining something the user knows with something they have or are. Bastion hosts, RBAC, and IP allowlisting are valuable defense-in-depth controls but do not enforce two-factor authentication on their own.

Answer

Deploying a bastion host that developers must use to reach repositories

Answer

Enforcing role-based access control (RBAC) on repositories

Answer

Configuring IP allowlisting for repository access