GSEC Practice Test 15 — 15 Questions

Question 1

A financial services firm is selecting a web application firewall (WAF) to protect an internet-facing banking portal that uses TLS 1.3 exclusively. The security architect must ensure the WAF can inspect encrypted sessions and detect attacks that unfold across many requests from the same client. Which TWO capabilities are MOST relevant to these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Terminating TLS at the WAF using a certificate and private key trusted by the portal's clients.. Inspecting TLS 1.3 forces the WAF to act as a TLS endpoint with the portal's certificate and key, because encrypted payloads are otherwise opaque. Detecting attacks spread across many requests requires persistent per-client session tracking and behavioral scoring, so those two capabilities together satisfy the architect's requirements.

Answer

Configuring the WAF to operate only in detection mode with alerts sent to a SIEM.

Answer

Enabling promiscuous mode on the WAF's management interface.

Answer

Disabling HTTP keep-alive so every request opens a fresh TCP connection.

Question 2

A security analyst is examining a Linux system for signs of compromise. The analyst notices that a suspicious process is running with a parent process ID (PPID) of 1. Which command will display the process tree, showing parent-child relationships, to help identify how the process was launched?

Accepted Answer

pstree -p. The pstree -p command provides a visual tree of processes with PIDs, making it straightforward to trace parent-child relationships. This is particularly useful when investigating a suspicious process whose PPID is 1, as it helps determine whether the process was legitimately started by init or if it was orphaned or injected. Other commands lack the hierarchical view needed for this analysis.

Answer

pgrep -l suspicious

Answer

top -H

Answer

ps -ef

Question 3

A security engineer is reviewing a production RHEL 9 server and finds that several users have entries in /etc/sudoers granting them NOPASSWD for specific commands. The engineer wants to verify which users can run commands as root without a password and also check for any syntax errors in the sudoers configuration. Which approach provides the most reliable verification?

Accepted Answer

Use 'visudo -c' to check syntax and 'grep -r NOPASSWD /etc/sudoers /etc/sudoers.d/' to enumerate passwordless entries.. To reliably verify passwordless sudo grants, the engineer needs to enumerate all NOPASSWD entries across the main sudoers file and any drop-in files, and to validate syntax. visudo -c performs a syntax check on all included files, while a recursive grep captures every NOPASSWD occurrence. Approaches that rely on individual user sessions or logs are either incomplete or reactive, and checking group membership alone misses per-user and per-command grants.

Answer

Run 'sudo -v' to validate the sudoers file and then use 'getent group sudo' to list all privileged users.

Answer

Run 'sudo -l' as each user to list their allowed commands and visually inspect /etc/sudoers for NOPASSWD entries.

Answer

Check the file permissions on /etc/sudoers and /etc/sudoers.d, then review the sudo log in /var/log/secure for NOPASSWD usage.

Question 4

A security administrator is implementing endpoint hardening on a fleet of Windows 10 laptops. The administrator wants to reduce the attack surface by disabling or restricting features that are commonly abused by attackers. Which TWO of the following actions are appropriate endpoint hardening measures? (Choose two.)

Accepted Answer

Enable PowerShell Constrained Language Mode for all users. Disabling Windows Script Host and enforcing PowerShell Constrained Language Mode both reduce the attack surface by limiting common attacker execution techniques. WSH is often abused for script-based malware, and Constrained Language Mode restricts PowerShell's ability to load arbitrary code. Together they harden endpoints without requiring third-party tools, while the other options either weaken security or introduce conflicts.

Answer

Disable User Account Control (UAC) to improve user productivity

Answer

Install a second third-party antivirus alongside Microsoft Defender Antivirus

Answer

Enable the Guest account and assign it a blank password for temporary access

Question 5

A security administrator is hardening a Linux server and needs to ensure that user passwords meet complexity requirements and are stored securely. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Ensure /etc/shadow is readable only by root and the shadow group.. To enforce password complexity, the administrator should configure pam_pwquality, which provides configurable checks for length, character classes, and dictionary words. To secure password storage, the administrator must ensure /etc/shadow is properly permissioned so that only root and the shadow group can read it, protecting hashes from unauthorized access. Other options either weaken security or do not address the specific requirements.

Answer

Disable password aging by setting PASS_MAX_DAYS to 99999.

Answer

Store passwords in /etc/passwd instead of /etc/shadow to simplify management.

Answer

Set the password hashing algorithm to SHA-256 in /etc/login.defs.

Question 6

A security engineer is hardening a Windows Server 2022 that hosts a Microsoft SQL Server instance. The server is domain-joined, and the SQL Server service currently runs under a domain user account. The engineer wants to implement a solution that provides automatic password management, supports Kerberos authentication, and allows the service to access network resources. The solution must also minimize the risk of password reuse across multiple servers. Which of the following should the engineer implement?

Accepted Answer

Group Managed Service Account (gMSA). A Group Managed Service Account (gMSA) is designed for services that need to access network resources and require automatic password management. It supports Kerberos and can be used across multiple servers without sharing the same password, reducing risk. The other account types either lack network access or cannot be shared across servers.

Answer

Standalone Managed Service Account (sMSA)

Answer

Virtual Service Account

Answer

Local Service account

Question 7

A security analyst is responding to a confirmed malware infection on a critical server. The analyst has already contained the infection by isolating the server from the network. According to the incident handling process, which TWO actions should the analyst perform during the eradication phase? (Choose two.)

Accepted Answer

Apply security patches and updates to the server's operating system and applications.. The correct actions are to identify and remove all malicious files and processes, and to apply security patches and updates. Eradication is the phase where the threat is eliminated from the environment. This includes removing malware and addressing the vulnerability that allowed the infection. Patching ensures that the same attack vector cannot be used again. Restoring from backup, post-incident review, and monitoring are associated with recovery or post-incident activities, not eradication.

Answer

Conduct a post-incident review to document lessons learned.

Answer

Restore the server from a known good backup taken before the infection.

Answer

Monitor network traffic for signs of re-infection.

Question 8

A security analyst is preparing to run an authenticated vulnerability scan against a Windows Server 2019 host. The analyst has domain credentials with local administrator rights on the target. Which Nmap scan type should the analyst use to perform a full TCP connect scan without requiring raw packet privileges?

Accepted Answer

nmap -sT. The TCP connect scan (-sT) is the correct choice because it relies on the operating system's networking stack and does not need raw socket access, making it usable by unprivileged users. Other scan types such as SYN, UDP, or ACK scanning require raw packet privileges and serve different purposes.

Answer

nmap -sU

Answer

nmap -sA

Answer

nmap -sS

Question 9

A security engineer is configuring an inline intrusion prevention system (IPS) on a 10 Gbps internal segment. During a pilot, the IPS begins dropping legitimate business traffic because its inspection engine cannot keep pace with bursts. Which deployment adjustment best preserves inline prevention while reducing false drops?

Accepted Answer

Tune the IPS inspection profile to match the segment's actual protocols and disable signatures for services not present on that segment.. Inline IPS overload is usually caused by inspecting traffic and signatures that do not apply to the protected segment. Profiling the segment and disabling irrelevant signatures reduces CPU and memory pressure, allowing the engine to keep up with burst traffic while still enforcing inline prevention. The other choices either remove inline enforcement or fail to address the actual capacity bottleneck, so they do not meet the requirement of preserving prevention while reducing false drops.

Answer

Enable fail-open bypass on the IPS so that traffic is forwarded without inspection when the inspection engine is overwhelmed.

Answer

Move the IPS to a passive TAP and rely on alerts to manually block offending sources at the firewall.

Answer

Increase the IPS fail-closed timeout so that traffic is buffered longer during inspection spikes.

Question 10

A security analyst is hardening a fleet of Linux servers and wants to reduce the risk of privilege escalation through file capabilities and setuid binaries. The analyst plans to audit and restrict these mechanisms. Which two actions best support this goal? (Choose two.)

Accepted Answer

Search for setuid binaries with 'find / -perm -4000 -type f' and remove the setuid bit from any binary not strictly required.. Reducing privilege escalation risk from setuid binaries and file capabilities requires discovering and minimizing them. Recursively enumerating capabilities with getcap and locating setuid files with find allows the analyst to identify unnecessary privilege grants and remove them. Blanket measures such as noexec mounts or immutable attributes are overly broad and break systems, while disabling sudo and using direct root logon weakens accountability instead of strengthening security.

Answer

Mount all filesystems with the 'noexec' option to prevent any binary from running.

Answer

Set the immutable attribute on all files owned by root using 'chattr +i' recursively.

Answer

Disable the sudo service and require all administrators to log in directly as root for administrative tasks.

Question 11

A network security team is deploying a web application firewall (WAF) in front of an e-commerce site. The security architect wants the WAF to learn normal application behavior and block deviations without manually writing signatures for every new attack. Which WAF deployment and configuration approach best matches this requirement?

Accepted Answer

Deploy the WAF in reverse proxy mode with anomaly detection and a learning period that builds a baseline of normal application behavior before enforcement.. Behavioral anomaly detection in a reverse proxy WAF builds a baseline of normal application behavior during a learning period, then flags and blocks requests that deviate from that baseline. This reduces reliance on manually written signatures and matches the architect's goal. Transparent bridge with a positive model still needs explicit definitions, monitor-only mode cannot block, and host-based static rules do not learn, so the reverse proxy anomaly approach is the only one that satisfies all stated requirements.

Answer

Deploy the WAF as a host-based agent on each web server with a static rule set based on the OWASP Core Rule Set.

Answer

Deploy the WAF in monitor-only mode with signature-based rules and alert on known attack patterns.

Answer

Deploy the WAF in transparent bridge mode with a positive security model that only allows explicitly defined methods, parameters, and content types.

Question 12

A healthcare provider is aligning its security program with the CIS Critical Security Controls. The security team is tasked with implementing CIS Control 1: Inventory and Control of Enterprise Assets. Which of the following activities is the most critical first step to ensure the control is effectively implemented?

Accepted Answer

Creating a formal policy that defines what constitutes an enterprise asset and assigns ownership for maintaining the inventory.. CIS Control 1 emphasizes the importance of a formalized process for inventory and control of enterprise assets. The initial step is to create a policy that defines the scope and assigns ownership. This ensures that the inventory is accurate, maintained, and aligned with organizational needs. Without this governance, technical implementations may lack direction and accountability, leading to an ineffective control.

Answer

Deploying an automated asset discovery tool to scan the network for all connected devices.

Answer

Implementing a configuration management database (CMDB) to store asset information.

Answer

Conducting a manual inventory of all assets in the data center.

Question 13

A security analyst is tuning a Splunk Enterprise correlation search that detects brute-force attempts against SSH. The current search fires thousands of alerts daily because it counts every failed password event, including those from a single user who mistypes a password once. The analyst needs to reduce noise while still catching distributed brute-force attacks. Which modification should the analyst make to the correlation search?

Accepted Answer

Correlate failed logins across multiple source IPs by counting distinct source IPs per target account over a longer window, and trigger when the distinct count exceeds a threshold.. Distributed brute-force attacks spread login attempts across many source IPs to evade per-IP thresholds. The effective detection method is to correlate failed logins by target account and count distinct source IPs over a longer period. This catches the attack while ignoring a single user's occasional mistyped password, reducing false positives without missing the distributed pattern.

Answer

Add a threshold condition that triggers only when more than 10 failed logins occur from the same source IP within 5 minutes.

Answer

Increase the search time window to 24 hours and lower the alert threshold to 5 failed logins per user.

Answer

Filter out all failed password events for service accounts and only alert on failed logins for interactive user accounts.

Question 14

A small business replaces its aging router with a unified threat management (UTM) appliance. The owner wants one device to provide antivirus scanning, content filtering, and intrusion prevention for all outbound traffic. Which statement BEST describes how the UTM appliance delivers these functions?

Accepted Answer

It combines multiple security functions in a single platform that inspects traffic as it passes through the appliance.. Unified threat management consolidates several inspection technologies into one appliance positioned in the traffic path, letting a small business obtain antivirus, content filtering, and intrusion prevention without procuring and managing separate devices.

Answer

It relies solely on signature updates pushed to endpoint agents installed on each workstation.

Answer

It functions only as a stateful firewall and requires separate appliances for each additional security service.

Answer

It offloads all inspection to a cloud service, requiring no local processing of network traffic.

Question 15

A financial services firm runs containerized workloads on a managed Kubernetes service. An auditor asks how the firm can ensure that only container images that passed its internal vulnerability scan can be deployed to the cluster. Which control should the firm implement?

Accepted Answer

Enable a Kubernetes admission controller that validates image signatures or scan attestations.. Admission control is the enforcement point in Kubernetes that can evaluate an image's signature or scan attestation before a pod is scheduled. By requiring a valid signature or attestation from the internal scanner, the firm guarantees that only images that passed its process can be deployed. Network policies, pull policies, and non-root settings affect runtime behavior but not image admissibility.

Answer

Set the imagePullPolicy to Always on every container manifest.

Answer

Configure the container runtime to run all pods as non-root users.

Answer

Configure a network policy that denies egress from all namespaces.