GSEC Practice Test 18 — 15 Questions

Question 1

A medium-sized company's Windows workstations are being infected by malicious macro documents delivered as .docm email attachments. Employees routinely open these attachments because the macros appear to come from a trusted internal sender. The security team wants to stop the macro execution with the least disruption to legitimate business macros, which are used only by the finance department. Which mitigation should the team implement first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Group Policy to set the Microsoft Office macro notification setting to 'Disable all macros except digitally signed macros' and distribute a trusted publisher certificate to finance.. The correct control is a Group Policy macro setting that disables unsigned macros while allowing digitally signed macros, with a trusted publisher certificate deployed to finance. This blocks the malicious macro execution path for nearly all users, preserves the legitimate finance macros, and requires no changes to email flow or third-party tools. It is the least disruptive, targeted mitigation for macro-borne malware in a Windows Office environment.

Answer

Enable Microsoft Defender Application Guard for Office to open untrusted documents in an isolated container.

Answer

Configure an email gateway rule to strip all .docm attachments and quarantine them for administrator review.

Answer

Deploy an endpoint detection and response agent and create a detection rule that alerts when WINWORD.EXE spawns a child process.

Question 2

A penetration tester is assessing a web application and finds that user input is reflected into an HTML page without encoding. The tester wants to demonstrate that an attacker could steal a victim's session cookie by injecting a script that sends the cookie to an external server. Which mitigation, when implemented by the developers, most directly prevents this specific cookie theft even if the input reflection remains?

Accepted Answer

Set the session cookie with the HttpOnly attribute.. The HttpOnly attribute makes the session cookie inaccessible to client-side scripts, so a reflected script injection cannot read or exfiltrate it. This directly counters the described attack even though the reflection vulnerability remains. While output encoding would fix the root cause and a strict Content Security Policy would reduce script execution, the question asks for the most direct prevention of cookie theft given the reflection, and HttpOnly is that control.

Answer

Add the Secure attribute to the session cookie.

Answer

Enable Content Security Policy with a strict script-src directive.

Answer

Implement output encoding for all user-supplied data.

Question 3

A forensic examiner is reviewing an NTFS volume from a Windows 11 laptop. The user claims a sensitive spreadsheet was only opened and never modified or renamed. The examiner notes that the $STANDARD_INFORMATION timestamps for the file are all recent, but the $FILE_NAME timestamps are from several months earlier. Which explanation best accounts for this discrepancy?

Accepted Answer

The file was accessed by a program that updated the $STANDARD_INFORMATION timestamps, and this behavior is a known anti-forensic technique or normal filesystem behavior depending on the API used.. NTFS maintains parallel timestamps in $STANDARD_INFORMATION and $FILE_NAME. Many APIs and many anti-forensic tools update only the $STANDARD_INFORMATION set, leaving $FILE_NAME untouched. A recent $STANDARD_INFORMATION paired with an older $FILE_NAME is a classic timestomping indicator and directly explains the discrepancy the examiner observed.

Answer

Windows 11 disables $FILE_NAME timestamp updates by default for user documents, so the older values simply reflect the file's creation date.

Answer

The $FILE_NAME timestamps record when the file was last backed up, while the $STANDARD_INFORMATION timestamps record live activity, so they legitimately differ after any backup.

Answer

The file was copied onto the volume from a remote share, which rewrote the $STANDARD_INFORMATION times while preserving the $FILE_NAME times from the source.

Question 4

A security administrator is configuring a macOS fleet to enforce that only apps signed with an Apple-issued Developer ID certificate and notarized by Apple can run. The administrator wants to verify the current Gatekeeper assessment status of a downloaded app at /Users/analyst/Downloads/Tool.app. Which command should the administrator use to perform this check?

Accepted Answer

spctl --assess --type execute --verbose /Users/analyst/Downloads/Tool.app. Gatekeeper assessment is performed by the spctl utility, which consults system policy to decide whether an app is permitted to execute. Running spctl with the assess action, the execute type, and verbose output against the target app returns an acceptance or rejection verdict along with the reason, which directly reflects Developer ID signing and notarization requirements enforced on the endpoint.

Answer

xattr -l /Users/analyst/Downloads/Tool.app

Answer

codesign --verify --deep --strict /Users/analyst/Downloads/Tool.app

Answer

system_profiler SPApplicationsDataType

Question 5

A security analyst is investigating a compromised Windows Server 2016 that is running an IIS web application. The analyst suspects that the attacker has created a malicious service to maintain persistence. Which of the following Windows Registry locations should the analyst examine to find the service's configuration?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Windows services are configured in the registry under HKLM\SYSTEM\CurrentControlSet\Services. Each service has a subkey with values like ImagePath and Start. A malicious service would create a subkey here to ensure it starts automatically. The other locations are used for different persistence mechanisms, such as user logon scripts or are non-existent.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Question 6

A security team is hardening a fleet of Windows 10 workstations against exploit techniques used by malicious code. The team wants to enable operating system features that make it harder for an attacker to execute arbitrary code in memory and to bypass address space randomization. Which two features should the team enable? (Choose two.)

Accepted Answer

Address Space Layout Randomization (ASLR) with system-wide mandatory enforcement.. Data Execution Prevention and system-wide mandatory Address Space Layout Randomization are the two operating system features that directly raise the bar for memory-corruption exploits. DEP prevents execution of code from data pages, defeating simple shellcode placement, while mandatory ASLR randomizes memory layout so attackers cannot rely on fixed addresses. Together they force attackers to find information leaks or other bypasses, which is the intended hardening posture for the workstation fleet.

Answer

Control Flow Guard (CFG) configured only for applications that opt in.

Answer

Structured Exception Handling Overwrite Protection (SEHOP) in audit-only mode.

Answer

Windows Defender Application Control (WDAC) in audit mode.

Question 7

A security analyst is reviewing Windows event logs to detect suspicious service installations. The analyst notices Event ID 7045 in the System log, indicating a new service was installed. The service name is 'UpdaterSvc', and the image path points to a binary in a user's temp folder. The analyst wants to determine the most likely security implication of this event. Which of the following best describes the risk?

Accepted Answer

The service represents a potential persistence mechanism used by an attacker to maintain access to the system.. Event ID 7045 in the System log indicates a new service was installed. When the service binary is located in a user's temp folder, it strongly suggests malicious activity, as legitimate services are installed in protected system directories. Attackers use services for persistence because they can start automatically and run with elevated privileges. The correct response is to treat this as a potential compromise and investigate further. The other options misinterpret the event or underestimate the risk.

Answer

The event indicates a driver installation, which could cause a blue screen of death.

Answer

The service is likely a legitimate Windows update service, and the event can be ignored.

Answer

The service installation is a sign of a Windows Update failure, and the system should be rolled back.

Question 8

A security consultant is advising a company that uses Windows Update for Business to manage Windows 10 devices. The company wants to ensure that devices receive feature updates only after they have been validated by the IT team, but without using Configuration Manager. Which WUfB feature should the consultant recommend to achieve this controlled rollout?

Accepted Answer

Deployment rings with staggered deferral periods. Deployment rings with staggered deferral periods are the WUfB feature that enables a controlled rollout. By placing a small set of devices in a pilot ring with a short deferral and the rest in a broad ring with a longer deferral, IT can validate the feature update on the pilot ring before it reaches the broader population. This achieves validation without Configuration Manager. Other options are for early access, bandwidth optimization, or reporting.

Answer

Windows Insider Program for Business rings

Answer

Update Compliance in Azure Log Analytics

Answer

Delivery Optimization peer-to-peer caching

Question 9

A financial services firm deploys 802.1X with EAP-TLS on its corporate WLAN. During an assessment, a consultant captures the 802.11 four-way handshake and observes that the attacker cannot derive the PMK because the exchange never leaves the client and RADIUS-issued credentials exposed. Which property of EAP-TLS best explains why this capture alone cannot be used to impersonate a legitimate client?

Accepted Answer

EAP-TLS performs mutual authentication using X.509 client and server certificates, so no reusable password-derived secret traverses the wireless medium.. EAP-TLS bases authentication on mutual X.509 certificate exchange, so neither a password nor a shared secret crosses the air. A captured four-way handshake yields only session-specific values that cannot be replayed or brute-forced into the PMK. Impersonation would require possession of the legitimate client's private key, which the passive capture does not provide.

Answer

EAP-TLS encrypts the entire four-way handshake inside the TLS tunnel, so the ANonce and SNonce are never visible to a passive observer.

Answer

EAP-TLS relies on PEAP inner-method tunneling, which wraps the client credential exchange in a protected TLS channel so offline dictionary attacks are impossible.

Answer

EAP-TLS uses a per-session PSK that the RADIUS server generates and transmits to the client over the encrypted tunnel, so each session key is unique and unrecoverable from the capture.

Question 10

A security administrator is planning to deploy Windows 10 feature updates to a pilot group of devices using Windows Update for Business. The administrator wants to ensure that the pilot group receives the feature update before the rest of the organization, so that any issues can be identified early. Which Windows Update for Business configuration should the administrator use?

Accepted Answer

Create a deployment ring with a feature update deferral of 0 days for the pilot group.. The correct answer is to create a deployment ring with a feature update deferral of 0 days for the pilot group. This ensures the pilot group receives feature updates immediately upon release, allowing early testing. Other settings either delay updates or affect the wrong update type, which would not achieve the goal of early pilot deployment.

Answer

Set a feature update deferral of 365 days for the pilot group.

Answer

Assign the pilot group to a ring with a feature update pause of 35 days.

Answer

Configure a quality update deferral of 0 days for the pilot group.

Question 11

A security administrator is configuring a macOS Big Sur endpoint to meet a compliance requirement that mandates all system extensions must be explicitly approved by the user. Which command should the administrator use to verify that only approved system extensions are loaded?

Accepted Answer

systemextensionsctl list. System extensions are a modern replacement for kernel extensions and require user approval before they can load. The systemextensionsctl list command provides a detailed list of all system extensions along with their approval status. This allows administrators to verify that only approved extensions are present, meeting the compliance requirement. The other commands either list kernel extensions or check different security features, so they do not provide the needed information.

Answer

csrutil status

Answer

spctl --status

Answer

kextstat

Question 12

A security researcher is evaluating the susceptibility of a WPA3-Personal network to offline dictionary attacks. Which statement accurately describes the resistance provided by WPA3-SAE compared to WPA2-PSK?

Accepted Answer

WPA3-SAE prevents offline dictionary attacks by using a simultaneous authentication of equals handshake that does not expose a crackable hash.. WPA3-SAE employs the Dragonfly handshake, which provides forward secrecy and prevents offline dictionary attacks by ensuring that the password is not exposed in a crackable form. An attacker must interact with the AP for each guess, making brute-force impractical. WPA2-PSK's 4-way handshake exposes a hash that can be cracked offline. The other options mischaracterize SAE's design or confuse it with unrelated features.

Answer

WPA3-SAE still allows offline dictionary attacks but requires more computational effort due to stronger encryption.

Answer

WPA3-SAE requires a captive portal to prevent offline attacks, as it does not encrypt management frames.

Answer

WPA3-SAE uses the same 4-way handshake as WPA2-PSK but with a longer key, making offline attacks infeasible.

Question 13

A retail chain wants to let customers join a guest WLAN without sharing the corporate preshared key, while still keeping guest traffic isolated from point-of-sale systems. Which design best meets these requirements?

Accepted Answer

Configure a separate guest SSID mapped to a dedicated VLAN with client isolation enabled and no route to internal subnets.. Guest access is best delivered on its own SSID mapped to a segmented VLAN with client isolation and no internal routing. This keeps the corporate preshared key private, prevents guest-to-guest and guest-to-internal access, and protects point-of-sale systems through network segmentation rather than relying on the guest credential.

Answer

Broadcast the corporate SSID with WPA3-SAE and give customers a rotating guest passphrase that changes weekly.

Answer

Deploy the guest network on the same SSID as corporate users and rely on 802.1X to assign guests a restricted role after authentication.

Answer

Enable a hidden guest SSID using WEP with a shared key so customers can connect without configuration changes.

Question 14

A security engineer is reviewing the WLAN configuration of a small business that uses WPA2-Personal. The owner wants to raise resistance to offline dictionary attacks against the preshared key without replacing all client hardware. Which two changes best accomplish this goal? (Choose two.)

Accepted Answer

Migrate the SSID to WPA3-SAE so the authentication exchange uses a simultaneous authentication of equals handshake resistant to offline guessing.. Offline dictionary attacks against WPA2-Personal succeed by deriving the PMK from a guessable passphrase and testing it against a captured handshake. Migrating to WPA3-SAE removes that offline attack path, and using a long random passphrase increases entropy so any captured material is impractical to crack. The two measures reinforce each other.

Answer

Enable 802.11w Management Frame Protection on the SSID to prevent capture of the four-way handshake.

Answer

Disable the SSID broadcast and enable MAC address filtering to prevent attackers from capturing the handshake.

Answer

Configure the AP to use TKIP instead of CCMP so that the captured handshake cannot be decrypted.

Question 15

A system administrator is hardening a Linux server and wants to ensure that users cannot log in with empty passwords. Which command should the administrator use to check for accounts with empty password fields in /etc/shadow?

Accepted Answer

awk -F: '($2 == "") {print $1}' /etc/shadow. To identify accounts with empty passwords, the most direct method is to parse /etc/shadow and check if the password hash field is empty. The awk command with field separator ':' and condition $2 == "" accomplishes this by printing the username for any line where the second field is empty. This is a common security audit technique. Other methods may work but are less precise or efficient. Ensuring no accounts have empty passwords is a fundamental Linux hardening step.

Answer

cut -d: -f1,2 /etc/shadow | grep ':$'

Answer

passwd -S $(cut -d: -f1 /etc/shadow) | grep 'NP'

Answer

grep -v '^[^:]*:[^:]*:' /etc/shadow