GSEC Practice Test 13 — 15 Questions

Question 1

A security team is configuring password policies for a Windows Active Directory domain. They need to enforce a setting that prevents users from reusing any of their last 24 passwords. Which password policy setting should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforce password history. The Enforce password history policy setting in Active Directory allows administrators to specify the number of previous passwords that cannot be reused. Setting it to 24 ensures users must choose 24 unique passwords before they can reuse an old one. This directly addresses the requirement to prevent reuse of the last 24 passwords. Other settings like maximum age, minimum age, or complexity do not track password reuse and therefore do not meet the stated goal.

Answer

Minimum password age

Answer

Password must meet complexity requirements

Answer

Maximum password age

Question 2

A security administrator is configuring a VPN concentrator to protect data in transit. The requirement is that each VPN session use a unique symmetric key, and that compromise of one session key never reveal another session's key or the long-term authentication secret. Which property must the key exchange provide?

Accepted Answer

Perfect forward secrecy, so that each session key is derived independently and compromise of one does not expose others or the long-term secret.. Perfect forward secrecy uses ephemeral key agreement such as Diffie-Hellman with per-session values, so the long-term authentication secret never encrypts session keys directly. Even if one session key is later compromised, the ephemeral secrets needed to derive other sessions have been erased, and the long-term secret remains protected.

Answer

Key encapsulation, so that the long-term secret directly encrypts each session key and guarantees confidentiality of the exchange.

Answer

Collision resistance, so that two different sessions cannot produce the same derived key material during the handshake.

Answer

Non-repudiation, so that each VPN endpoint can prove it participated in the session and cannot deny sending traffic.

Question 3

A security analyst is reviewing how a file encryption tool protects data at rest on employee laptops. The tool must ensure that an attacker who copies the encrypted file cannot decrypt it without also obtaining the user's passphrase, and that modification of the ciphertext is detectable. Which TWO design elements should the analyst verify are present? (Choose two.)

Accepted Answer

A password-based key derivation function with a unique random salt and a high iteration count is used to derive the file encryption key.. A salted, high-iteration KDF makes passphrase guessing expensive and prevents cross-file precomputation, while authenticated encryption binds a tag to the ciphertext so any modification is detected. Together they ensure a copied file cannot be decrypted without the passphrase and that tampering is evident.

Answer

The file is encrypted with a stream cipher using a nonce that is reused across all files for simplicity.

Answer

A static initialization vector equal to the file creation timestamp is used for every encryption operation to ensure reproducibility.

Answer

The encryption key is embedded in the file header obfuscated with Base64 so the tool can decrypt without prompting the user.

Question 4

A security analyst is tuning the SIEM to reduce noise. The current rule fires whenever a Windows event with ID 4625 (failed logon) occurs. Which modification should the analyst make to the rule to better identify a brute-force attack while reducing false positives?

Accepted Answer

Change the rule to trigger only when the same source IP generates more than 10 failed logons within 5 minutes.. Brute-force attacks are characterized by a high volume of failed authentication attempts from a single source in a short period. A threshold-based correlation rule that counts failures per source IP within a time window effectively separates automated attacks from occasional user mistypes, reducing false positives while maintaining detection fidelity.

Answer

Set the rule to alert only when event ID 4625 occurs outside of business hours.

Answer

Add a filter to exclude all failed logon events from privileged accounts.

Answer

Configure the rule to trigger only when event ID 4625 is followed by event ID 4624 (successful logon) from the same user within 1 minute.

Question 5

A security engineer at a hospital is deploying an inline network Intrusion Prevention System (IPS) on a 10 Gbps link between the clinical VLAN and the data center. The IPS must block exploits without introducing latency that would disrupt real-time patient monitoring. Which deployment consideration is MOST critical to meet this requirement?

Accepted Answer

Verify the IPS can perform inspection at line rate with low latency and has a hardware bypass mechanism to maintain availability if it fails.. An inline IPS on a critical 10 Gbps link must inspect and block at line rate while not introducing latency that disrupts real-time applications. A hardware bypass or fail-to-wire mechanism is essential to maintain network availability if the IPS fails, which is especially important in a hospital setting. Performance and availability are the key considerations for this deployment.

Answer

Configure the IPS in tap mode with a fail-open bypass so it can inspect traffic without being in the forwarding path.

Answer

Enable full packet capture on the IPS to record all traffic for forensic analysis, accepting the performance overhead.

Answer

Deploy the IPS in promiscuous mode and rely on span ports to mirror traffic from the core switch.

Question 6

A security administrator is reviewing authentication logs and notices that an attacker successfully authenticated to a VPN using a valid username and password, but the attacker did not possess the user's hardware token. The VPN is configured to require both a password and a one-time code from a hardware token. Which attack technique most likely allowed the attacker to bypass the hardware token requirement?

Accepted Answer

Man-in-the-middle attack. A man-in-the-middle attack allows an attacker to intercept and relay authentication credentials, including one-time codes, in real time. If the attacker can position themselves between the user and the VPN, they can capture both the password and the token code as they are transmitted. The attacker then uses these to authenticate before the code expires, effectively bypassing the need to physically possess the hardware token. Other attacks like pass-the-hash, credential stuffing, or brute-force do not provide the one-time code.

Answer

Credential stuffing

Answer

Pass-the-hash

Answer

Brute-force attack

Question 7

A Windows 10 workstation in a high-security environment must be configured so that only digitally signed and approved kernel-mode drivers can load, blocking unsigned or tampered drivers that could be used for rootkit installation. Which Windows feature should the administrator enable to enforce this requirement?

Accepted Answer

Device Guard with Code Integrity policies. Device Guard with Code Integrity policies enforces that only trusted, signed kernel-mode drivers can load, directly preventing unsigned or tampered drivers from being used for rootkits. BitLocker, AppLocker, and Windows Defender Firewall address different security concerns—data encryption, application control, and network filtering—and do not provide kernel-mode driver integrity enforcement. Therefore, Device Guard is the correct solution.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker with TPM and PIN

Answer

AppLocker with default rules

Question 8

An organization is deploying a new VPN solution and wants to ensure that authentication credentials are not transmitted in cleartext over the internet. The security team decides to use a protocol that encapsulates authentication within a TLS tunnel. Which protocol should they implement?

Accepted Answer

EAP-TTLS. EAP-TTLS encapsulates authentication within a TLS tunnel, protecting credentials from eavesdropping. PAP sends cleartext, CHAP uses a non-TLS challenge-response, and MS-CHAPv2 lacks TLS encapsulation. Only EAP-TTLS meets the requirement of transmitting authentication securely within a TLS tunnel, making it the correct protocol for the VPN deployment.

Answer

CHAP

Answer

PAP

Answer

MS-CHAPv2

Question 9

A financial institution uses a stateful firewall between its internal network and the internet. An administrator notices that return traffic for outbound connections is being blocked even though the outbound rules are correct. The firewall logs show that the return packets are being dropped because they do not match any existing session. Which feature should the administrator verify is enabled to allow return traffic for legitimate outbound sessions?

Accepted Answer

Stateful inspection with session tracking. Stateful inspection with session tracking allows the firewall to dynamically permit return traffic for outbound connections by maintaining a session table. Without it, return packets are treated as new inbound traffic and may be blocked by default. The administrator should verify that stateful inspection is enabled and that the session table is not exhausted, which can cause drops.

Answer

Access control lists (ACLs) applied to the inbound interface

Answer

Deep packet inspection (DPI) with application signatures

Answer

Network address translation (NAT) with port forwarding

Question 10

A healthcare organization is implementing CIS Control 14: Security Awareness and Skills Training. The security manager needs to ensure that the training program effectively reduces phishing susceptibility among employees. Which of the following approaches best aligns with the control's requirements?

Accepted Answer

Implement a phishing simulation program with regular campaigns, provide immediate feedback to users who click, and track improvement over time.. CIS Control 14 emphasizes continuous security awareness training that includes simulated phishing exercises to test and reinforce employee skills. A program with regular phishing simulations, immediate feedback, and tracking of improvement directly measures and reduces susceptibility. Other options are either too infrequent or passive, failing to provide the practical, ongoing reinforcement that the control requires.

Answer

Require employees to complete a computer-based training module on phishing once per quarter and pass a quiz.

Answer

Send monthly security newsletters to all staff highlighting recent phishing trends and best practices.

Answer

Conduct annual security awareness training for all employees and track completion rates.

Question 11

A security analyst is reviewing the configuration of a VPN gateway that uses IPsec in tunnel mode. The analyst notices that the gateway is configured to use IKEv2 with a pre-shared key (PSK) for authentication. Which of the following is the PRIMARY security concern with this configuration?

Accepted Answer

PSK authentication is vulnerable to offline dictionary attacks if an attacker captures the handshake.. Pre-shared key authentication in IKEv2 relies on a secret that is shared among peers. If an attacker captures the authentication exchange, they can attempt to guess the PSK offline, especially if it is weak. This makes PSK authentication vulnerable to dictionary attacks, which is a primary security concern compared to certificate-based authentication.

Answer

PSK authentication cannot be used with IKEv2; it requires IKEv1.

Answer

PSK authentication does not encrypt the IKEv2 handshake, exposing the PSK in plaintext.

Answer

PSK authentication does not provide perfect forward secrecy (PFS).

Question 12

A security administrator is configuring a Linux server to encrypt a new block device that will store sensitive data. The administrator wants to ensure that data is encrypted at rest and that the encryption key is protected by a passphrase. Which of the following tools is designed specifically for this purpose?

Accepted Answer

dm-crypt with LUKS. dm-crypt with LUKS is the standard Linux solution for block device encryption. dm-crypt provides the kernel-level encryption, while LUKS provides a standardized header and key management, allowing multiple passphrases to unlock the encryption key. This directly meets the requirement of encrypting a block device with a passphrase-protected key.

Answer

eCryptfs

Answer

OpenSSL

Answer

GnuPG (GPG)

Question 13

A security team wants to implement application whitelisting on a set of Windows 10 workstations to prevent users from running unauthorized executables. They need a solution that integrates with Group Policy and allows rules based on file path, hash, or publisher. Which built-in Windows feature should they use?

Accepted Answer

AppLocker. AppLocker is the built-in Windows feature designed for application whitelisting, with rule types based on path, hash, or publisher, and it integrates with Group Policy. WDAC is more complex and less Group Policy-centric, SRP is deprecated, and Windows Defender Firewall does not control application execution. Therefore, AppLocker is the correct solution.

Answer

Software Restriction Policies (SRP)

Answer

Windows Defender Application Control (WDAC)

Answer

Windows Defender Firewall

Question 14

A network architect is designing a new data center fabric that must support a large number of tenants with strict isolation requirements. The design uses a spine-leaf topology with VXLAN overlay. The architect must ensure that broadcast, unknown unicast, and multicast (BUM) traffic from one tenant never reaches another tenant's virtual tunnel endpoints (VTEPs). Which mechanism should be implemented to meet this requirement?

Accepted Answer

Assign each tenant a unique VXLAN Network Identifier (VNI) and map each VNI to a separate bridge domain on every leaf switch.. In a VXLAN overlay, tenant isolation is achieved by assigning each tenant a distinct VNI and bridge domain. VTEPs flood BUM traffic only within the same VNI, so segments remain logically separate even though they share the same physical spine-leaf fabric. IGMP snooping, anycast gateway MACs, and separate physical fabrics do not provide the required per-tenant Layer 2 boundary in a shared overlay.

Answer

Enable IGMP snooping on all leaf switches so multicast traffic is pruned to only the ports that requested the group.

Answer

Configure a unique anycast gateway MAC address on each leaf switch to prevent hosts from roaming between tenants.

Answer

Use a separate physical spine-leaf fabric for each tenant and interconnect them with a firewall.

Question 15

A security administrator is configuring a Linux server and needs to enforce that all user passwords are hashed with a strong, salted algorithm. Which file should the administrator edit to set the default password hashing algorithm for new passwords?

Accepted Answer

/etc/login.defs. The /etc/login.defs file contains the ENCRYPT_METHOD setting, which specifies the default password hashing algorithm for new passwords on many Linux distributions. Editing this file allows the administrator to enforce a strong, salted algorithm like SHA512. While /etc/shadow stores hashes and PAM configures authentication, the default algorithm is set in login.defs. Therefore, this is the correct file to edit.

Answer

/etc/pam.d/common-password

Answer

/etc/passwd

Answer

/etc/shadow