GSEC Practice Test 19 — 15 Questions

Question 1

A security engineer is implementing file integrity monitoring on a Linux server. The engineer wants to use AIDE to detect unauthorized changes to critical system files. After initializing the AIDE database, which command should be used to perform a manual check and compare the current file system state against the baseline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aide --check. AIDE (Advanced Intrusion Detection Environment) is a file integrity checker. After initializing the baseline database with aide --init, the administrator uses aide --check to compare the current file system against that baseline. The check reports any discrepancies, which can indicate unauthorized changes. The --update option is used to accept changes and update the database, while --init creates a new baseline. There is no --compare option. Therefore, aide --check is the correct command for a manual integrity verification.

Answer

aide --update

Answer

aide --compare

Answer

aide --init

Question 2

You are troubleshooting a service startup failure on a web server. Based on the error code in the exhibit, what is the most likely cause?

Accepted Answer

The service account credentials are invalid or locked.. The error code 0x8007052e corresponds to 'Logon failure: unknown user name or bad password'. In the context of Windows services, this indicates that the credentials provided for the service account are either incorrect or the account is locked out in Active Directory. Resolving this requires verifying the account password or checking for account lockouts in the domain controller logs to ensure the service can successfully authenticate.

Answer

The service account lacks the 'Log on as a service' right.

Answer

The network path to the domain controller is unreachable.

Answer

The service binary is corrupted or missing.

Question 3

A security analyst is hardening a web server to ensure that only modern, secure protocols are used for HTTPS traffic. Which configuration best aligns with GSEC security standards for data in transit?

Accepted Answer

Disable SSL and TLS 1.0/1.1, allowing only TLS 1.2 and 1.3.. Disabling legacy protocols like SSLv3 and TLS 1.0 is essential to prevent downgrade attacks like POODLE. By mandating TLS 1.2 or higher, the organization ensures that cryptographic primitives remain robust against known vulnerabilities. This practice is foundational for GSEC-compliant environments, as it mitigates the risk of man-in-the-middle interception where outdated handshake mechanisms allow attackers to force the use of weaker, exploitable encryption algorithms during the initial connection setup.

Answer

Support TLS 1.0, 1.1, and 1.2 to maintain maximum backward compatibility.

Answer

Enable SSLv3 for clients who cannot support newer TLS versions.

Answer

Use RC4 for all connections to ensure high performance over low-bandwidth links.

Question 4

Which THREE of the following are primary defensive strategies to mitigate the risk of 'Living off the Land' (LotL) attacks?

Accepted Answer

Restrict access to administrative tools via Constrained Language Mode.. LotL attacks use legitimate system tools (e.g., PowerShell, WMI, PsExec) for malicious purposes to avoid detection. Mitigation requires strict monitoring and restriction of these powerful utilities. By reducing the attack surface via restrictive policies, logging their usage, and implementing least-privilege principles, organizations can detect the abuse of these tools by an adversary, as their usage patterns will deviate significantly from the baseline behavior of legitimate system administrators and automated system management processes.

Answer

Increase the frequency of system reboots.

Answer

Disable all network logging to save disk space.

Question 5

Which THREE of the following actions are considered best practices when hardening an enterprise wireless infrastructure?

Accepted Answer

Disable WPS on all wireless access points.. Hardening a wireless network requires a layered defense approach. Disabling unused features like WPS prevents direct exploitation, implementing WPA3 or WPA2-Enterprise ensures strong cryptographic bounds, and using a Wireless Intrusion Prevention System (WIPS) allows for the continuous monitoring and mitigation of rogue devices. These three steps cover the primary vectors of wireless attack: protocol flaws, weak authentication, and unauthorized infrastructure deployment.

Answer

Enable SSID hiding to conceal the network.

Answer

Use WEP for legacy hardware compatibility.

Question 6

A hospital's wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. A security engineer discovers that an attacker can capture a client's authentication exchange and crack the password offline. Which change most directly mitigates this specific attack?

Accepted Answer

Configure EAP-TLS with client certificates for all wireless clients.. PEAP-MSCHAPv2 transmits an MSCHAPv2 challenge-response that can be captured and cracked offline because the protocol's DES-based keying is weak and lacks channel binding. Replacing it with EAP-TLS removes the password-derived secret entirely, requiring client certificates for mutual authentication. PMF, 802.11w, and PSK length changes do not alter the inner EAP method, so they leave the offline cracking vulnerability intact.

Answer

Deploy Protected Management Frames (PMF) on all access points.

Answer

Enable 802.11w on the wireless controller.

Answer

Increase the WPA2 pre-shared key length to 64 characters.

Question 7

An incident responder needs to determine the last time a specific user interacted with a Windows workstation. Which registry hive should be analyzed to retrieve the LastWrite time of the user's NTUSER.DAT file?

Accepted Answer

The user's NTUSER.DAT hive. The NTUSER.DAT file contains user-specific registry settings. Analyzing the LastWrite time of this hive provides insight into when the user profile was last active. In forensics, tracking user activity is critical for establishing a timeline of unauthorized access or insider threats. Examiners must cross-reference this with event logs to confirm if the activity aligns with the suspected malicious incident window.

Answer

SYSTEM hive

Answer

SAM hive

Answer

SOFTWARE hive

Question 8

A startup is deploying a containerized web application on a managed Kubernetes service. The security lead wants to ensure that if a container is compromised, the attacker cannot easily move laterally to other workloads or the underlying node. Which Kubernetes feature most directly restricts a compromised container's ability to reach other pods and node services?

Accepted Answer

NetworkPolicy resources that define allowed ingress and egress traffic for selected pods.. By default, Kubernetes allows all pods to communicate with each other and with node services. NetworkPolicy provides a declarative way to restrict ingress and egress at the pod level, effectively segmenting workloads so a compromised container cannot reach unrelated services or the node. Admission controls and resource quotas address different concerns and do not constrain network paths.

Answer

ResourceQuota objects that limit CPU and memory consumption per namespace.

Answer

Horizontal Pod Autoscaler configured to scale replicas based on CPU utilization.

Answer

PodSecurityPolicy admission controller configured to disallow privileged containers.

Question 9

Which TWO of the following practices are recommended to mitigate the risk of 'Model Inversion' attacks in an AI/ML deployment?

Accepted Answer

Apply differential privacy noise to the training dataset.. Model inversion attacks involve querying an ML model to reconstruct sensitive training data. To mitigate this, developers must limit the information revealed by the API and implement differential privacy. These techniques ensure that individual data records cannot be reverse-engineered from model outputs. This is essential for maintaining compliance with privacy regulations like GDPR and CCPA, which mandate the protection of training data from unauthorized reconstruction.

Answer

Increase the confidence interval thresholds in the model API output.

Answer

Implement multi-factor authentication for all API management endpoints.

Answer

Regularly rotate the API keys used to access the inference model.

Question 10

Refer to the exhibit. A user attempts to delete a file located inside '/opt/backup', but the operation fails with a 'Permission denied' error. Given the directory permissions shown, what is the most likely cause?

Accepted Answer

The user lacks write permission on the /opt/backup directory.. The directory permissions 'drwxr-xr-x' indicate that the owner (root) has full control, while others have read and execute access. However, because the user is neither root nor the directory owner, they lack write permission (w) on the parent directory. In Linux, deleting a file requires write and execute permissions on the directory containing it, not just the file itself. This mechanism protects directory integrity from unauthorized modifications by non-privileged users.

Answer

The user lacks the execute permission on the /opt/backup directory.

Answer

The file inside the directory is owned by root and is immutable.

Answer

The user does not have the 'sudo' command available in their path.

Question 11

You are auditing a Windows Server environment and identify that a service is configured to log on as a 'Group Managed Service Account' (gMSA). What is the primary security advantage of using this account type over a standard domain user account?

Accepted Answer

They automatically rotate passwords without service restarts.. gMSAs provide automatic password management, where the Windows OS handles password rotation without manual intervention or service downtime. This significantly reduces the risk of password compromise or credential theft via brute-force or persistent local storage. By removing the need for human administrators to manage long-lived static credentials, gMSAs enforce a robust security posture that adheres to modern standards for service identity lifecycle management and long-term protection against credential-based lateral movement.

Answer

They enable Kerberos constrained delegation by default.

Answer

They bypass the need for an SPN registration.

Answer

They allow for local interactive logons on all domain controllers.

Question 12

A junior administrator is setting up a shared folder on a Windows Server 2022 member server. The folder will be accessed by a group called 'SalesTeam'. The administrator wants to ensure that members of SalesTeam can read and write files, but cannot change permissions or take ownership. Which NTFS permission should the administrator assign to the SalesTeam group?

Accepted Answer

Modify. The Modify permission provides the necessary read and write access without granting the ability to change permissions or take ownership. It is the standard choice for groups that need to collaborate on files. Full Control would be excessive, while Write and Read & execute each lack essential capabilities for the scenario.

Answer

Write

Answer

Read & execute

Answer

Full Control

Question 13

When designing a defense in depth strategy, why is it recommended to use heterogeneous security controls rather than homogeneous ones?

Accepted Answer

To ensure that a single vulnerability does not bypass all defense layers.. Heterogeneous controls provide diversity, ensuring that a single flaw or vulnerability in one vendor's product does not compromise the entire defense. In a homogeneous environment, if an attacker discovers a bypass for one control, they can apply that same technique across all layers. Using different technologies or vendors increases the probability that at least one layer will successfully stop the threat, thereby making the overall environment significantly more resilient against targeted attacks.

Answer

To reduce the overall cost of software licensing and maintenance.

Answer

To simplify the process of configuring and managing security logs.

Answer

To minimize the need for external security audits and compliance checks.

Question 14

A security auditor notices that wireless clients are frequently disconnected by de-authentication frames that contain a spoofed MAC address of the access point. What is the auditor witnessing?

Accepted Answer

A de-authentication Denial of Service (DoS) attack.. This behavior is characteristic of an 802.11 de-authentication attack. By sending spoofed management frames that appear to originate from the legitimate access point, an attacker can force clients to disconnect. This is often a precursor to forcing clients to reconnect to an attacker-controlled Evil Twin AP, enabling the interception of credentials or the execution of further man-in-the-middle attacks.

Answer

A standard re-keying process defined by WPA2 standards.

Answer

An automated load balancing mechanism on the AP.

Answer

A probe response flood from an adjacent network.

Question 15

Which Windows feature allows for fine-grained access control based on user attributes like department or project code rather than just security groups?

Accepted Answer

Dynamic Access Control (DAC). Dynamic Access Control (DAC) allows administrators to create policies based on resource and user properties, providing a more flexible and scalable alternative to traditional security groups. This is essential in large organizations where maintaining thousands of security groups becomes unmanageable. DAC enhances the GSEC focus on least privilege by enabling context-aware access decisions that adapt automatically as user attributes change within Active Directory or file metadata.

Answer

Access-Based Enumeration (ABE)

Answer

NTFS Permissions

Answer

User Account Control (UAC)