GSEC Practice Test 2 — 10 Questions

Question 1

During a forensic examination, you find a Prefetch file named 'MALWARE.EXE-A1B2C3D4.pf'. What is the significance of the hexadecimal string appended to the filename?

Accepted Answer

It is a hash derived from the file's execution path.. Windows Prefetch files store metadata about application execution to speed up startup times. The hash appended to the filename is calculated based on the path from which the application was executed. This allows investigators to differentiate between multiple instances of the same binary running from different directories, which is a common technique used by attackers to hide malicious binaries in non-standard, obfuscated system locations.

Answer

It is a randomized identifier generated at system boot.

Answer

It represents the hash of the file's content.

Answer

It is the timestamp of the last execution.

Question 2

An organization is migrating to a hybrid cloud environment. Which security control is most effective for preventing unauthorized lateral movement between virtual machines residing on the same physical hypervisor?

Accepted Answer

Utilizing micro-segmentation policies via distributed firewalls.. Micro-segmentation is critical in virtualized environments because traditional network perimeter defenses cannot see traffic moving between VMs on the same host. By applying host-based or hypervisor-level firewalls, security teams restrict traffic based on identity and function rather than IP address. This mitigates the risk of a compromised workload pivoting to sensitive internal assets within the shared virtual infrastructure, which is a key security requirement for modern cloud architectures.

Answer

Deploying a Network Intrusion Detection System (NIDS) at the virtual switch level.

Answer

Implementing a traditional hardware-based firewall at the edge of the datacenter.

Answer

Enforcing full disk encryption on all virtual hard drives.

Question 3

After a major security breach, the incident response team conducts a lessons-learned meeting. The team identifies that the initial detection was delayed because log sources were not properly integrated into the SIEM. Which phase of the incident response lifecycle does this finding primarily aim to improve?

Accepted Answer

Preparation. The finding that log sources were not integrated into the SIEM points to a gap in preparation. Preparation involves setting up logging, monitoring, and detection tools. By addressing this, the team enhances future detection capabilities. While the review occurs in Post-Incident Activity, the corrective action targets Preparation.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 4

A penetration tester is reviewing the TLS configuration of an e-commerce web server. The tester observes that the server prefers the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA during the handshake. Which security weakness does this cipher suite selection introduce?

Accepted Answer

It lacks forward secrecy because the RSA key exchange does not generate ephemeral session keys.. The cipher suite TLS_RSA_WITH_AES_128_CBC_SHA relies on static RSA key exchange, where the client encrypts a premaster secret with the server's public key. This means the session key is tied to the server's long-term private key. If that private key is compromised later, an attacker who recorded the encrypted session can decrypt it retroactively. Forward secrecy requires ephemeral key exchanges like ECDHE or DHE, which generate unique session keys that are not recoverable from the long-term key.

Answer

It uses AES in CBC mode, which is vulnerable to padding oracle attacks such as POODLE.

Answer

It uses SHA-1 for integrity, which is considered cryptographically broken for MACs.

Answer

It allows downgrade to export-grade cryptography because of the RSA key exchange.

Question 5

A security analyst is reviewing logs from a Linux web server that has been compromised. The analyst notices a large number of requests to a specific URL that include encoded characters such as %27, %20, and %3D. The web server logs show these requests in the access log with a 200 OK response. Which type of attack is most likely indicated by these log entries?

Accepted Answer

SQL injection. The encoded characters %27 (single quote), %20 (space), and %3D (equals) are commonly used in SQL injection attempts to manipulate SQL queries. The single quote is used to terminate strings, spaces separate SQL keywords, and equals signs are used in comparisons. The successful 200 OK responses suggest the application may be vulnerable. Other attack types would exhibit different patterns in the logs.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

Command injection

Question 6

A security analyst is reviewing a web application's HTTP response headers and notices the following header: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'. The analyst is concerned about the application's resilience to cross-site scripting (XSS). Which of the following best describes the security implication of this policy?

Accepted Answer

The policy is insecure because it allows inline scripts, which can be exploited by XSS attacks.. The Content-Security-Policy header includes 'unsafe-inline' in the script-src directive, which permits inline JavaScript execution. This directly undermines CSP's ability to prevent XSS attacks, as injected inline scripts will run. The correct answer identifies that allowing inline scripts makes the policy insecure. The other options incorrectly focus on external script restrictions or reporting, missing the critical weakness.

Answer

The policy is insecure because it lacks a report-uri directive, so violations cannot be monitored.

Answer

The policy is secure because default-src 'self' prevents loading scripts from external domains, mitigating XSS.

Answer

The policy is secure because it restricts scripts to the same origin and disallows inline scripts.

Question 7

A healthcare provider is designing a defense in depth strategy for its electronic health record (EHR) system. The security architect proposes using a different vendor's endpoint detection and response (EDR) product, a different firewall brand, and a different SIEM platform than those used by the rest of the organization. The CIO asks why heterogeneous controls are preferred over standardizing on a single vendor. Which statement best justifies the architect's recommendation?

Accepted Answer

Using different vendors ensures that a single exploit or misconfiguration cannot simultaneously compromise all layers of defense.. Heterogeneous security controls create independent failure domains. If one vendor's product has a vulnerability or is misconfigured, the others are unlikely to share the same flaw, so a single exploit cannot disable all layers. This diversity strengthens defense in depth by preventing common-mode failures, which is the architect's core justification for mixing vendors in the EHR environment.

Answer

Heterogeneous controls reduce licensing costs because multiple vendors compete for the same functionality.

Answer

Different vendors provide more comprehensive log formats that are easier to correlate in the SIEM.

Answer

Heterogeneous controls are required by HIPAA for any system that stores electronic protected health information.

Question 8

An administrator observes unauthorized devices connecting to an enterprise wireless network using WPA2-Personal. Which mitigation strategy best prevents credential sharing and ensures unique authentication for every employee?

Accepted Answer

Transition to WPA2-Enterprise utilizing 802.1X authentication with EAP-TLS.. Moving from WPA2-Personal to WPA2-Enterprise (802.1X) forces each user to authenticate against a central RADIUS server using unique credentials. This eliminates the risk of shared PSKs, which are easily compromised when employees leave or share them. This transition is a foundational requirement for securing enterprise wireless environments and ensuring accountability through centralized logging and per-user access control.

Answer

Implement MAC address filtering on all wireless access points.

Answer

Increase the PSK complexity to a 64-character alphanumeric string.

Answer

Enable hidden SSIDs to prevent unauthorized discovery.

Question 9

A retail company is adopting the CIS Critical Security Controls and wants to prioritize its efforts. According to the CIS Controls, which of the following is the first basic control that should be implemented to gain visibility into assets?

Accepted Answer

Inventory and Control of Enterprise Assets. Inventory and Control of Enterprise Assets is the first CIS Control because it establishes the foundation for all other controls. You cannot protect what you do not know exists. An accurate asset inventory enables effective vulnerability management, privilege control, and incident response. The CIS Controls are prioritized, with Control 1 as the starting point for any organization.

Answer

Email and Web Browser Protections

Answer

Continuous Vulnerability Management

Answer

Controlled Use of Administrative Privileges

Question 10

A retail company runs a stateful firewall at its internet edge. Users complain that long-lived SSH sessions to a partner are being dropped roughly every hour even though no idle timeout is configured on the client. Which firewall behavior is the MOST likely cause?

Accepted Answer

The firewall's TCP session table entry is expiring because the connection has been idle longer than the configured state timeout.. Stateful inspection maintains a session table whose entries expire according to protocol idle timers. An SSH connection that sends no data for the duration of the TCP established timeout is silently removed, after which the firewall no longer recognizes return packets as part of an existing flow and drops them.

Answer

The firewall is applying egress filtering that blocks the partner's return traffic after the first hour.

Answer

The firewall is performing full packet reassembly and rejecting out-of-order TCP segments from the partner.

Answer

The firewall's ALG for SSH is rewriting the sequence numbers and desynchronizing the endpoints.