GSEC Practice Test 14 — 15 Questions

Question 1

A security administrator is hardening a fleet of Windows 10 endpoints against credential theft attacks such as Pass-the-Hash and credential dumping. Which TWO of the following measures directly mitigate these threats by protecting credentials in memory and restricting their use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Credential Guard. Credential Guard and LSA protection directly protect credentials in memory. Credential Guard isolates derived credentials using virtualization-based security, preventing their theft. LSA protection blocks non-PPL processes from reading LSA memory, thwarting credential dumping tools. SMB signing, Windows Defender Firewall, and BitLocker address other security aspects but do not directly prevent credential theft from memory.

Answer

Enable BitLocker with TPM

Answer

Enforce SMB signing

Answer

Deploy Windows Defender Firewall with domain profile

Question 2

A security architect must ensure that hosts on a guest wireless network cannot reach any internal RFC 1918 subnets, while still allowing guests to reach the internet and a captive portal hosted internally for authentication. The design uses a wireless controller that tunnels guest traffic to a dedicated guest anchor. Which approach best enforces the requirement?

Accepted Answer

Assign guests addresses from an isolated guest subnet and apply an ACL on the guest anchor that denies traffic to all internal RFC 1918 ranges while permitting the captive portal host and internet-bound traffic.. Guest traffic tunneled to a dedicated anchor can be filtered where it enters the network, and an ACL that denies RFC 1918 destinations while permitting the captive portal and internet traffic enforces exactly the stated policy. Client isolation, core-level blanket drops, and route publication either fail to block internal access or break required services. The anchor is the correct enforcement point because it sees all guest traffic before it reaches internal resources.

Answer

Assign guests addresses from an isolated guest subnet and publish a route to the internal network, relying on the internal firewalls' implicit deny to block guest access.

Answer

Assign guests addresses from an isolated guest subnet and configure the internal core switches to drop all traffic sourced from that subnet.

Answer

Assign guests addresses from the internal corporate DHCP scope and rely on the wireless controller's client isolation feature to prevent guests from reaching internal hosts.

Question 3

A financial services firm is designing a key management process for its internal certificate authority. The security architect wants a single hardware security module (HSM) cluster to protect the CA's signing key while ensuring that a compromise of one HSM appliance does not expose the key in plaintext to an attacker who gains root on that appliance. Which deployment property BEST addresses this requirement?

Accepted Answer

Configure the HSM cluster so the CA key is generated in and never leaves the tamper-protected boundary, with cryptographic operations performed inside the module.. Keeping the CA private key generated within and never exportable from the HSM's tamper-protected boundary ensures that even root compromise of the host operating system cannot yield plaintext key material. Signing occurs inside the module, so the key is never exposed to the host. Validation levels and secret-sharing schemes address adjacent concerns but do not prevent plaintext exposure to a privileged local attacker.

Answer

Split the CA key using Shamir's Secret Sharing and store one share on each HSM, reconstructing the key in memory when signing is required.

Answer

Enable FIPS 140-3 Level 1 validation on the HSM and replicate the CA key to a standby appliance using a vendor export command.

Answer

Store the CA private key in an encrypted file on each HSM's local disk, protected by a passphrase entered at boot.

Question 4

A security analyst is investigating a suspicious file on a Linux server. The analyst wants to determine the file's inode number, permissions, owner, group, size, and last modification time without modifying the file. Which command should the analyst use?

Accepted Answer

stat filename. The stat command is designed to display comprehensive file metadata, including the inode number, permissions, ownership, size, and timestamps. Unlike ls, it includes the inode number, which is crucial for forensic analysis. Other commands like file and du provide limited information and do not meet the requirement for a complete metadata overview.

Answer

file filename

Answer

du -h filename

Answer

ls -l filename

Question 5

A junior administrator is asked to make a web server reachable from the internet without exposing the internal database server that the web application uses. The web server sits in a screened subnet, and the database resides on the internal network. Which architecture correctly implements this requirement?

Accepted Answer

Place the web server in the screened subnet with inbound HTTP and HTTPS permitted from the internet, and permit only the web server's IP to reach the database on its listening port.. A screened subnet isolates internet-facing services from internal data stores, and restricting database access to the web server's address enforces that boundary at the network layer. Internet clients reach only the web tier, so compromising it does not grant direct access to the database or the broader internal network. Co-locating the database in the screened subnet or opening its listener to any source undermines the isolation the design requires.

Answer

Place the web server in the screened subnet and enable a database listener that accepts connections from any source, relying on database authentication to prevent unauthorized access.

Answer

Place both the web server and the database in the screened subnet, and permit inbound HTTP and HTTPS from the internet to the web server.

Answer

Place the web server on the internal network and publish it through a reverse proxy that forwards requests directly to the database server.

Question 6

A security administrator is hardening a fleet of Windows 10 endpoints against credential theft attacks such as Pass-the-Hash and credential dumping. Which TWO of the following measures directly mitigate these threats by protecting credentials in memory and restricting their use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network security: Restrict NTLM: NTLM authentication in this domain. The 'Network security: Restrict NTLM: NTLM authentication in this domain' policy explicitly controls NTLM usage for domain accounts. Setting it to 'Deny all' blocks NTLM authentication and forces Kerberos, which is the desired outcome. Other settings may harden NTLM or Kerberos but do not disable NTLM entirely.

Answer

Network security: LAN Manager authentication level

Answer

Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

Answer

Network security: Configure encryption types allowed for Kerberos

Question 7

A company's incident response plan requires a formal lessons-learned review after a major ransomware incident. Which TWO activities are appropriate during the Post-Incident Activity phase? (Choose two.)

Accepted Answer

Conduct a meeting with stakeholders to review what worked, what failed, and how to improve the plan.. The Post-Incident Activity phase is about learning from the incident and improving future response. Holding a stakeholder review meeting and updating the IR plan and detection rules based on findings both directly serve that purpose. Recovery and eradication actions belong to earlier phases, and containment is likewise an earlier-phase activity, so they are not appropriate here.

Answer

Reimage all affected endpoints and restore data from the most recent backups.

Answer

Isolate the compromised network segment to prevent the ransomware from spreading further.

Answer

Eradicate the ransomware binaries and remove persistence mechanisms from infected hosts.

Question 8

A security engineer is configuring a Linux server to enforce password quality for all local accounts. The requirement is that passwords must be at least 14 characters long, contain at least one uppercase letter, one lowercase letter, one digit, and one special character, and must not repeat any of the last 5 passwords. Which file should the engineer edit to enforce these settings?

Accepted Answer

/etc/security/pwquality.conf. Password complexity and history requirements on Linux are enforced by the pam_pwquality module, which reads its configuration from /etc/security/pwquality.conf. This file allows administrators to set minlen, character class requirements, and other constraints. While PAM configuration files like system-auth or common-password reference the module, the policy parameters themselves are defined in pwquality.conf. Therefore, editing /etc/security/pwquality.conf is the correct action to meet the stated password policy.

Answer

/etc/pam.d/login

Answer

/etc/login.defs

Answer

/etc/shadow

Question 9

A security architect is designing a defensible network architecture for a new campus. The architect must implement controls that limit the spread of malware from an infected endpoint to other endpoints on the same VLAN. Which TWO actions should be included in the design? (Choose two.)

Accepted Answer

Implement 802.1X with dynamic VLAN assignment so endpoints are placed into role-based segments based on identity and posture.. Limiting malware spread on a campus network requires segmenting endpoints at Layer 2. 802.1X with dynamic VLAN assignment places devices into role-based segments, and private VLANs prevent direct host-to-host communication within a VLAN. Together they reduce the blast radius of an infection. Honeypots, DHCP snooping with IP Source Guard, and host-based IPS improve detection or integrity but do not provide the network segmentation needed to contain lateral movement.

Answer

Implement a host-based intrusion prevention system (HIPS) on every endpoint to block malicious traffic at the source.

Answer

Deploy a honeypot on each VLAN to detect and automatically blackhole infected endpoints.

Answer

Configure DHCP snooping and IP Source Guard on all access ports to validate endpoint IP and MAC bindings.

Question 10

A security team is investigating a compromised Linux server. The attacker gained initial access through a web application and then established persistence. The team wants to identify the mechanism used to maintain access across reboots. Which Linux artifact should the team examine first to find scheduled tasks that run automatically?

Accepted Answer

/etc/crontab and the /etc/cron.* directories. System-wide cron files and directories are the primary location for scheduled tasks on Linux. Attackers frequently add entries to /etc/crontab or /etc/cron.* to run malicious commands at boot or regular intervals, ensuring persistence across reboots. Examining these files first aligns with the goal of identifying how the attacker maintains access after a restart.

Answer

/etc/hosts

Answer

/var/log/auth.log

Answer

/etc/passwd

Question 11

A healthcare provider must protect laptops that store electronic protected health information (ePHI). The security team wants to ensure that if a laptop is lost or stolen, the data on the drive remains confidential even if an attacker removes the drive and connects it to another computer. The team also wants to minimize the risk of cold-boot attacks that could extract encryption keys from memory. Which full disk encryption configuration best meets these requirements?

Accepted Answer

BitLocker with TPM and PIN protector, plus pre-boot authentication. BitLocker with a TPM and PIN protector enforces pre-boot authentication, so the drive cannot be unlocked without the PIN and the TPM-bound key. This protects against offline drive removal and reduces the window for cold-boot or DMA attacks because the operating system and keys are not loaded until the PIN is entered, satisfying both confidentiality and cold-boot risk reduction.

Answer

BitLocker with a startup key stored on a USB flash drive

Answer

BitLocker with TPM-only protector and no PIN

Answer

EFS encryption of the ePHI folders with user certificates

Question 12

A security team is conducting a post-incident review after a successful ransomware attack. The team identifies that the initial infection vector was a phishing email that delivered a malicious macro. The team wants to improve future response. Which of the following actions is MOST effective for preventing a similar incident from succeeding in the future?

Accepted Answer

Disable macros in Microsoft Office applications by default and only allow signed macros from trusted publishers.. The most effective action is to disable macros by default and allow only signed macros from trusted publishers. This directly prevents the malicious macro from executing, regardless of whether the phishing email reaches the user. It is a technical control that enforces a secure configuration and reduces the attack surface. While other measures like training, EDR, and email filtering add defense in depth, they are not as reliable in stopping this specific vector. Disabling macros is a best practice recommended by security organizations.

Answer

Implement a security awareness training program that teaches employees to recognize phishing emails.

Answer

Deploy an endpoint detection and response (EDR) solution to detect and block malicious macro execution.

Answer

Configure email filtering to block all emails with macro-enabled attachments.

Question 13

A security administrator is hardening a fleet of Windows 10 endpoints against credential theft attacks such as Pass-the-Hash and credential dumping. Which TWO of the following measures directly mitigate these threats by protecting credentials in memory and restricting their use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Leave /home mounted without 'noexec' and instead enforce execution control through SELinux booleans or AppArmor profiles that restrict which binaries the scheduled process may run.. The scenario requires balancing operational need with hardening. Mount options like noexec and nosuid are valuable for directories that should never host executables, but /home may legitimately need to run scripts. Applying mandatory access control lets specific processes execute approved files while blocking everything else, preserving security without breaking the developer's scheduled process. A blanket noexec on /home is too restrictive, and moving execution to world-writable temporary directories undermines the server's defenses.

Answer

Remove the 'noexec' option from /tmp and /var/tmp so the developer can move scripts there and execute them, keeping /home locked down.

Answer

Add the 'nosuid' option to /home only, because nosuid prevents all executable files from running and resolves the developer's concern.

Answer

Remount /home with the 'noexec' option and require the developer to store and execute scripts from /var/tmp instead.

Question 14

A junior administrator is asked to verify the integrity of a downloaded Linux distribution ISO before installing it on a production server. The vendor publishes a SHA-256 checksum and a detached PGP signature. Which action BEST confirms both that the file is intact and that it genuinely originated from the vendor?

Accepted Answer

Import the vendor's public key, verify the detached signature against the ISO, and confirm the signature is valid.. A valid detached PGP signature verified with the vendor's trusted public key simultaneously proves that the file content is unchanged and that it was signed by the vendor's private key. The hash comparison alone provides integrity but not origin, and encryption or antivirus scanning addresses entirely different concerns. The public key must be obtained and validated through a trusted channel.

Answer

Run the ISO through an antivirus scanner and confirm no malware is detected.

Answer

Compute the SHA-256 hash of the ISO and compare it to the published checksum only.

Answer

Encrypt the ISO with the vendor's public key and confirm the operation succeeds.

Question 15

You are a security analyst at a company that suspects an insider is exfiltrating files from a Windows Server 2019 file server. You need to enable auditing to record every time a file is read or written on a specific shared folder, while minimizing the volume of unrelated events. Which of the following should you do first?

Accepted Answer

Enable the "Audit File System" subcategory under Object Access in Advanced Audit Policy Configuration.. To audit file reads and writes on a specific folder, you must first enable the Audit File System subcategory in Advanced Audit Policy Configuration. This provides granular control and reduces noise compared to legacy basic auditing. After enabling this subcategory, you would then configure a system access control list (SACL) on the folder to specify which users and access types to audit. This combination ensures that only relevant events are logged, aligning with the principle of least privilege and efficient monitoring.

Answer

Enable the "Audit Handle Manipulation" subcategory to capture file access attempts.

Answer

Configure a basic audit policy by enabling "Audit object access" in the Local Security Policy.

Answer

Create a new Data Collector Set in Performance Monitor to track file access on the shared folder.