GSEC Practice Test 17 — 15 Questions

Question 1

You are a security analyst at a financial firm. A Windows Server 2019 domain controller is suspected of unauthorized access. You need to determine which user accounts were used to log on interactively to that server during the past week. Which Windows Event ID should you examine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Event ID 4624. Interactive logons generate Event ID 4624 with Logon Type 2. This event records the account name, logon type, and other details, making it the primary source for identifying which accounts were used for interactive access. Other events like 4634, 4648, and 4672 serve different purposes and do not directly show interactive logon activity.

Answer

Event ID 4648

Answer

Event ID 4672

Answer

Event ID 4634

Question 2

A security architect is designing a remote access solution and wants to protect against credential theft and man-in-the-middle attacks while allowing employees to use personal devices. The solution must not require installing a client certificate on the personal device. Which approach best meets these requirements?

Accepted Answer

Deploy a TLS-based VPN portal with multi-factor authentication, server certificates, and HSTS enforced.. The design must authenticate the server, resist credential theft, resist man-in-the-middle, and avoid client certificates on personal devices. A TLS-based VPN portal with MFA and server certificates meets all of these: the client validates the server certificate, MFA blocks stolen-password reuse, and HSTS prevents downgrade attacks. The other options either require client certificates, rely on weak shared secrets, or use reusable basic credentials.

Answer

Publish the internal application through a reverse proxy that uses basic authentication over HTTPS.

Answer

Deploy an IPsec VPN that requires a client certificate issued to each device.

Answer

Deploy an IPsec VPN with pre-shared keys distributed to each employee's device.

Question 3

A vulnerability scan of a production web server reports a critical remote code execution vulnerability, but the system administrator insists the server is fully patched. The scanner used only unauthenticated checks. Which step should the security analyst take FIRST to resolve the discrepancy?

Accepted Answer

Perform an authenticated scan and manually verify the vulnerability on the host. Unauthenticated scans infer vulnerabilities from banners and service responses, which can produce false positives. To resolve the conflict between the scanner and the administrator, the analyst should perform an authenticated scan that reads installed package versions and manually verify the issue on the host. This provides definitive evidence and avoids both unnecessary downtime and premature closure of a critical finding.

Answer

Rescan the server with a different unauthenticated scanner to compare results

Answer

Immediately take the server offline to prevent exploitation

Answer

Accept the administrator's statement and close the finding as a false positive

Question 4

A security analyst at a financial firm suspects that an attacker used a service account to create a new local administrator on a Windows 10 workstation. The analyst runs `auditpol /get /category:*` and sees that the 'Account Management' subcategory is set to 'No Auditing'. Which action should the analyst take to capture future events of this type while minimizing noise?

Accepted Answer

Enable the 'Account Management' subcategory with both Success and Failure auditing.. The Account Management subcategory is specifically designed to log changes to user accounts and groups, including creation, deletion, and membership modifications. Enabling both Success and Failure auditing ensures that any attempt to add a local administrator is recorded, whether it succeeds or fails. This directly targets the suspicious activity while avoiding the overhead of unrelated audit categories.

Answer

Enable the 'Policy Change' subcategory with Success auditing only.

Answer

Enable the 'Detailed Tracking' subcategory with Success auditing only.

Answer

Enable the 'Logon/Logoff' subcategory with Failure auditing only.

Question 5

An incident responder is analyzing a Windows 10 workstation that is suspected of being used to exfiltrate data. The responder runs 'wevtutil qe Security /q:"*[System[(EventID=5156)]]" /f:text' but finds no events. Which action will most reliably produce the network connection telemetry the responder needs for this investigation?

Accepted Answer

Enable the 'Audit Filtering Platform Connection' policy under Advanced Audit Policy Configuration and ensure the Security log is large enough to retain events.. Event ID 5156 is generated only when the Filtering Platform Connection audit subcategory is enabled through Advanced Audit Policy Configuration; the default configuration does not log these events, which explains the empty query result. Enabling the subcategory and providing adequate log capacity gives the responder the process, user, and endpoint details required to trace the suspected exfiltration activity on the workstation.

Answer

Set the Security log retention method to 'Overwrite events as needed' and increase the maximum log size to 1 GB.

Answer

Run 'netsh trace start capture=yes' and review the resulting ETL file in Event Viewer under the Microsoft-Windows-TCPIP operational log.

Answer

Enable the 'Audit Process Creation' policy and configure the 'Include command line in process creation events' setting to capture outbound connections.

Question 6

A security engineer is hardening a Kubernetes cluster that runs multi-tenant workloads. Several pods have been observed running as the root user inside their containers, which the engineer wants to prevent. The engineer applies a Pod Security Admission (PSA) label to the namespace that enforces the 'restricted' profile. Which of the following best describes the enforcement action taken by the 'restricted' profile when a pod violates its policy?

Accepted Answer

The pod is rejected and the API server returns an error, preventing it from being scheduled.. The restricted Pod Security Standard is the most restrictive of the three built-in profiles and enforces controls such as requiring non-root execution, dropping all capabilities, and mandating a seccomp profile. When a namespace enforces this profile, non-compliant pods are denied at admission, directly preventing root-running containers from being scheduled.

Answer

The pod is admitted but an audit annotation is added to the pod's metadata for later review.

Answer

The pod is scheduled but the kubelet forcibly changes the container's user to a non-root UID at runtime.

Answer

The pod is admitted and a warning is written to the API server logs, but no enforcement action is taken.

Question 7

A network security team is reviewing how name resolution traffic can be abused. An analyst notes that a compromised host is generating a high volume of DNS queries for long, random-looking subdomains under a single external domain, and responses contain similarly encoded data. The team wants to classify this activity and describe the underlying mechanism. Which statement best characterizes what is occurring?

Accepted Answer

DNS tunneling, where data and commands are encoded into DNS queries and responses to create a covert channel.. Encoding data into DNS query names and response records creates a covert channel known as DNS tunneling. High-entropy subdomain labels and a sustained query volume toward one external domain are the hallmarks. The resolver forwards queries to the attacker's authoritative server, which returns encoded responses. This differs from zone transfers, cache poisoning, and amplification, which have distinct traffic signatures and objectives.

Answer

A DNS amplification attack, where spoofed queries generate large responses aimed at a victim.

Answer

DNS cache poisoning, where forged responses insert malicious records into a resolver's cache.

Answer

A zone transfer abuse, where the attacker pulls the entire DNS zone from an authoritative server.

Question 8

An organization is implementing a Windows Defender Application Control (WDAC) policy to block unauthorized executables on Windows 10 endpoints. The security team wants to ensure that only signed binaries from trusted publishers are allowed to run, but they also need to allow a specific in-house application that is not signed. What is the most appropriate approach?

Accepted Answer

Use a hash rule to allow the specific unsigned application by its file hash.. WDAC allows exceptions for specific files using hash rules. This is the most appropriate method to permit an unsigned application while still enforcing the policy for all other executables. Hash rules are precise and secure because they tie the exception to the exact file content. Disabling WDAC, using publisher rules without a signature, or switching to audit mode would either weaken security or not work.

Answer

Create a publisher rule for the in-house application's certificate, even though it is not signed.

Answer

Set WDAC to audit mode so that the unsigned application can run without being blocked.

Answer

Disable WDAC enforcement for the entire endpoint to allow the unsigned application to run.

Question 9

You are a security consultant reviewing a Windows Server 2016 environment. The client wants to ensure that all administrative actions are logged and can be traced back to individual administrators. Currently, all administrators use a shared domain admin account. Which security control should you recommend to meet this requirement?

Accepted Answer

Implement separate administrative accounts for each administrator.. The core issue is that shared accounts prevent attribution. To trace administrative actions to individuals, each administrator must have a unique account. This ensures that audit logs record the specific user who performed each action. Other options address audit policy settings but do not solve the fundamental problem of shared credentials.

Answer

Configure a Group Policy Object to enable 'Audit process tracking' for all servers.

Answer

Enable the 'Audit: Force audit policy subcategory settings' policy.

Answer

Enable 'Audit: Shut down system immediately if unable to log security audits'.

Question 10

A security analyst at a financial firm is reviewing wireless traffic captured near the executive conference room. The capture shows a flood of 802.11 management frames with source addresses set to the company's legitimate AP MAC address, but the frames are not encrypted and are arriving at a high rate. Which type of attack is most likely occurring?

Accepted Answer

A deauthentication flood using spoofed management frames.. The flood of unencrypted 802.11 management frames with a spoofed AP MAC address is a classic deauthentication attack. Attackers use this to disconnect clients from the legitimate AP, often to capture the WPA handshake or to force clients to connect to a rogue AP. The high rate and spoofed source distinguish it from other wireless attacks that manipulate encrypted frames or handshake processes.

Answer

A rogue access point broadcasting a duplicate SSID to lure clients.

Answer

A KRACK key reinstallation attack against the WPA2 four-way handshake.

Answer

A WPA3 Dragonblood downgrade attack forcing the use of WPA2.

Question 11

A security analyst at a financial firm discovers that a user's workstation is executing a malicious macro embedded in a Microsoft Word document. The macro is attempting to download a second-stage payload from a remote server. The analyst wants to prevent this specific type of attack from succeeding on other workstations while allowing legitimate macros to run. Which of the following is the MOST effective mitigation?

Accepted Answer

Enable Microsoft Office's 'Block macros from running in Office files from the Internet' policy via Group Policy.. The 'Block macros from running in Office files from the Internet' policy is specifically designed to mitigate macro-based malware delivered via email or web downloads. It uses Mark-of-the-Web to identify files from untrusted sources and blocks macro execution while allowing macros in trusted local files. This balances security with usability, making it the most effective targeted mitigation for the described attack.

Answer

Disable all macros without notification in the Trust Center settings for all Office applications.

Answer

Deploy a web proxy that blocks all outbound traffic to unknown domains to prevent payload download.

Answer

Implement an application whitelist that only allows signed Microsoft Office executables to run.

Question 12

A penetration tester is examining a Windows 10 system and discovers that a recent exploit leveraged a use-after-free vulnerability in a widely used PDF reader application. The exploit successfully achieved code execution. Which of the following mitigation technologies, when enabled, would have made this exploitation significantly more difficult by randomizing the memory locations of key data structures?

Accepted Answer

Address Space Layout Randomization (ASLR). ASLR is the mitigation that randomizes memory addresses, making it harder for an attacker to predict where to find or place code and data. In a use-after-free scenario, the attacker often needs to control the contents of a freed object and then trigger its reuse; ASLR forces the attacker to first leak a memory address to bypass randomization, adding a significant hurdle. DEP, CFG, and SEHOP address different exploitation techniques and do not provide the same randomization benefit.

Answer

Control Flow Guard (CFG)

Answer

Data Execution Prevention (DEP)

Answer

Structured Exception Handling Overwrite Protection (SEHOP)

Question 13

A security administrator wants to enable PowerShell script block logging on a Windows 10 workstation to capture suspicious script content. The administrator runs `Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'`. Which registry value should be configured to enable this feature?

Accepted Answer

EnableScriptBlockLogging (DWORD) set to 1. Script block logging is enabled by setting the EnableScriptBlockLogging DWORD value to 1 under the ScriptBlockLogging registry key. This logs script blocks to Event ID 4104, providing visibility into potentially malicious scripts. Other logging features like module logging and transcription serve different purposes and are configured elsewhere.

Answer

EnableTranscripting (DWORD) set to 1

Answer

EnableScriptBlockInvocationLogging (DWORD) set to 1

Answer

EnableModuleLogging (DWORD) set to 1

Question 14

A security analyst is reviewing an incident where a user's browser was exploited by a drive-by download. The analyst wants to confirm whether the exploit achieved code execution and established persistence. Which artifact should the analyst examine first to determine if a new service was created for persistence on the Windows host?

Accepted Answer

The System event log for event ID 7045 Service Control Manager entries.. The System event log entry with ID 7045 is generated by the Service Control Manager whenever a new service is installed on Windows. It captures the service name, binary path, start type, and account, which lets the analyst confirm both installation and the persistence mechanism. Unlike process creation auditing, 7045 is enabled by default and directly answers whether a service was created, making it the correct first artifact to examine.

Answer

The Application event log for Windows Error Reporting crash entries.

Answer

The browser's cache folder for recently downloaded JavaScript files.

Answer

The Windows Security event log for event ID 4688 process creation.

Question 15

A security administrator manages a fleet of Windows 10 Enterprise devices that must remain on version 1809 because a critical line-of-business application is only certified for that build. The organization uses Windows Update for Business (WUfB) and wants to prevent these devices from receiving feature updates for 18 months while still receiving quality updates. Which WUfB setting should the administrator configure?

Accepted Answer

Configure a Windows Update for Business target version using the TargetReleaseVersion and TargetReleaseVersionInfo policies.. TargetReleaseVersion and TargetReleaseVersionInfo allow an administrator to pin Windows 10 devices to a specific feature update version, such as 1809, while continuing to receive quality updates. This is the supported method in Windows Update for Business to prevent feature updates for an extended period without disabling updates entirely. Deferrals and pauses are temporary and do not meet the 18-month requirement.

Answer

Disable the Windows Update service and manage quality updates through a third-party patch management tool.

Answer

Set the feature update deferral period to 365 days and enable Pause feature updates for 35 days.

Answer

Assign the devices to the Semi-Annual Channel (Targeted) ring and set a 365-day feature update deferral.