GSEC Practice Test 20 — 15 Questions

Question 1

When evaluating an endpoint's disk encryption, why is 'Pre-Boot Authentication' (PBA) considered a critical security component?

Accepted Answer

It requires authentication before the encryption keys are released to memory.. PBA ensures that the encryption keys are not loaded into memory until the user provides the correct credentials at boot time. Without PBA, the encryption is transparent once the OS starts, meaning if the device is stolen while powered on or in sleep mode, an attacker could potentially access the data. PBA provides a strong gatekeeper that protects the data at rest even before the OS loads.

Answer

It improves the speed of system startup and file indexing.

Answer

It ensures that the computer cannot be booted from an external drive.

Answer

It automatically syncs the encryption keys to a cloud-based backup.

Question 2

What is the primary purpose of the 'Notarization' process for macOS applications?

Accepted Answer

To scan for malicious code and verify developer identity.. Notarization is an automated system that scans software for malicious content and verifies that it is signed by a registered developer. It provides a level of assurance to users that the software has been reviewed by Apple. For GSEC, understanding notarization is crucial because it bridges the gap between basic code signing and runtime execution, ensuring that even signed software meets baseline security standards before deployment.

Answer

To provide full-disk encryption for the application data.

Answer

To restrict application access to user contact data.

Answer

To enforce system-level integrity of the kernel.

Question 3

Which of the following represents an example of applying defense in depth at the host level?

Accepted Answer

Configuring local host firewalls and endpoint detection and response (EDR) software.. Host-level defense in depth involves implementing multiple security controls directly on individual servers or workstations to create a resilient environment. If an attacker bypasses the network perimeter, host-based controls like EDR and local firewalls provide the final barrier. This multi-faceted approach ensures that even if a network segment is compromised, the specific endpoint remains protected and monitored, preventing widespread damage and aiding in rapid incident response and threat isolation.

Answer

Installing a web application firewall at the network edge.

Answer

Implementing multi-factor authentication for corporate VPN access.

Answer

Deploying a network intrusion detection system (NIDS) in promiscuous mode.

Question 4

An administrator identifies a suspicious process masquerading as a system service. To mitigate the risk while maintaining evidence, which action is the most appropriate first step in a professional incident response lifecycle?

Accepted Answer

Isolate the infected host from the network via switch port shutdown.. Isolating the host from the network preserves the integrity of the volatile memory and prevents command-and-control communication. In security operations, containment precedes deep analysis to ensure the adversary cannot execute further malicious actions or delete artifacts. This approach balances the need for forensic readiness with the urgent requirement to stop ongoing lateral movement or data exfiltration, adhering to standard GIAC incident response methodologies regarding host-based threat containment.

Answer

Immediately terminate the process using the task manager.

Answer

Perform a full system backup to an external network share.

Answer

Run a full scan with the local antivirus engine.

Question 5

A security architect is hardening an organization's network infrastructure against reconnaissance and layer-2 attacks. Which TWO actions should the engineering team take to mitigate common switch-based vulnerabilities? (Choose TWO)

Accepted Answer

Disabling dynamic trunking protocol on all user-facing access layer switch ports.. Mitigating layer-2 vulnerabilities requires disabling dynamic trunking protocol auto-negotiation and explicitly setting native VLAN identifiers to unused, isolated values. Disabling dynamic trunk negotiation stops rogue switches from forming trunk links, while changing the native VLAN prevents VLAN hopping attacks that exploit un-tagged traffic handling on trunk links.

Answer

Enabling dynamic ARP inspection across all core routing interfaces without configuring DHCP snooping bindings.

Answer

Routing all broadcast domain traffic through unmanaged Layer-1 repeating hubs to obscure physical topology.

Answer

Installing public-facing web servers directly into the native management VLAN of the core enterprise switches.

Question 6

Which THREE of the following are considered best practices for auditing Windows event logs to enhance security monitoring?

Accepted Answer

Centralize logs to a SIEM for long-term storage. Effective log auditing relies on consistency, central collection, and meaningful alerting. By setting a large log size, ensuring remote aggregation, and auditing critical security-related events, organizations move from reactive to proactive monitoring. These practices are essential for ensuring that evidence is preserved during an incident and that alerts are generated for high-value security events before they are rotated out of the local logs.

Answer

Audit every single file access on the system

Answer

Require domain admins to clear logs daily

Question 7

A junior administrator needs to determine the default gateway configured on a Linux server to troubleshoot outbound connectivity. Which command will display the routing table and show the default route?

Accepted Answer

ip route show. To view the default gateway, the administrator should inspect the routing table. The 'ip route show' command outputs all routes, including the default route that specifies the gateway via which packets are sent when no other route matches. Interface configuration and socket statistics tools do not expose routing information, so they cannot answer the question.

Answer

netstat -tuln

Answer

ss -s

Answer

ifconfig -a

Question 8

Which TWO of the following statements are true regarding the use of WPA3 compared to WPA2?

Accepted Answer

WPA3 uses SAE to replace the vulnerable WPA2 PSK exchange.. WPA3 introduces significant security improvements over WPA2. SAE (Simultaneous Authentication of Equals) replaces the vulnerable PSK exchange, providing forward secrecy and protection against offline dictionary attacks. Additionally, WPA3 mandates Protected Management Frames (PMF), which prevents the de-authentication attacks that plague WPA2. These enhancements make WPA3 the current standard for protecting wireless networks against common interception and session-hijacking techniques.

Answer

WPA3 is fully backward compatible with all WEP-based devices.

Answer

WPA3 removes the requirement for 802.1X authentication entirely.

Answer

WPA3 encryption is strictly limited to 64-bit keys.

Question 9

A security analyst is investigating a suspected man-in-the-middle attack against an HTTPS service. The analyst finds that the client is ignoring certificate validation errors. Which cryptographic failure is most likely occurring?

Accepted Answer

Improper certificate chain verification. The failure to validate certificates allows an attacker to present a forged certificate that the client blindly trusts. This breaks the fundamental trust model of PKI, allowing an attacker to intercept, inspect, and potentially modify encrypted traffic. This is a common flaw in poorly configured internal applications where developers disable validation to bypass expired or self-signed certificate warnings, creating a significant security hole that leaves users vulnerable to eavesdropping and credential theft.

Answer

Lack of Perfect Forward Secrecy

Answer

Weak cipher suite negotiation

Answer

Use of outdated TLS 1.0 protocol

Question 10

An organization is reviewing CIS Control 11: Data Recovery. Which of the following activities best demonstrates adherence to the 'testing' requirement of this control?

Accepted Answer

Conducting a periodic, documented restore process to verify data integrity.. The testing requirement in CIS Control 11 is critical because backups are useless if they cannot be successfully restored. Organizations must not only perform regular backups but also systematically test those backups to verify data integrity and recovery speed. This ensures that in the event of a ransomware attack or accidental data loss, the organization has a reliable, validated path to restore operations quickly and minimize downtime effectively.

Answer

Running a full system backup every night at 2:00 AM.

Answer

Storing all backup tapes in an off-site, climate-controlled facility.

Answer

Encrypting all backup media to prevent unauthorized access.

Question 11

A startup is deploying a web application on a public cloud infrastructure-as-a-service platform. The security lead wants to ensure that the operating system patches, application code, and firewall rules within the guest are the startup's responsibility, while the physical hosts and hypervisor are the provider's. Which cloud concept clarifies this division?

Accepted Answer

The shared responsibility model. The shared responsibility model is the framework that assigns security ownership between the cloud provider and the customer. For IaaS, the provider handles the physical datacenter, hardware, and hypervisor, while the customer is responsible for the guest OS, applications, and guest-level firewall configuration. The other concepts address access scope, layered controls, or automation, not the division of duties.

Answer

Infrastructure as code

Answer

Defense in depth

Answer

The principle of least privilege

Question 12

Refer to the exhibit. What is the security impact of the provided Kubernetes security context configuration?

Accepted Answer

The container is protected against setuid-based privilege escalation.. This configuration enforces the principle of least privilege by ensuring the container cannot run as root and preventing any process from gaining more privileges than its parent. 'allowPrivilegeEscalation: false' is a critical setting that prevents setuid binaries from changing the process effective user ID, which is a common technique used by attackers to escalate privileges within a container after achieving initial execution.

Answer

The pod will be unable to pull the image from the registry.

Answer

The pod will block all network traffic from the container.

Answer

The application will automatically have its vulnerabilities patched.

Question 13

A security administrator is hardening a Linux web server. The administrator needs to ensure that the Apache service, which runs as the user 'www-data', cannot be used to escalate privileges if compromised. Which file should the administrator check to verify that 'www-data' does not have a valid login shell?

Accepted Answer

/etc/passwd. The login shell for a user is stored in the seventh field of /etc/passwd. Service accounts like 'www-data' should have a non-interactive shell such as /usr/sbin/nologin to prevent attackers from obtaining a shell if the service is compromised. Other files contain password hashes, group data, or sudo rules, but none store the login shell assignment.

Answer

/etc/sudoers

Answer

/etc/group

Answer

/etc/shadow

Question 14

An information security auditor discovers a custom compiled binary in a shared directory with the following permissions: -rwsr-xr-x. The file is owned by the root user. What is the primary security implication of this finding?

Accepted Answer

The binary executes with the privileges of the root user.. Understanding special permissions like SUID is critical for Linux security because they often lead to privilege escalation vulnerabilities. When the SUID bit is set on a file owned by root, any user who executes that file gains root-level privileges for the duration of the process. If the binary is poorly written, it can be exploited.

Answer

The file can be modified by any user in the group.

Answer

The file is encrypted and requires a password to run.

Answer

The binary is restricted to running only in runlevel 1.

Question 15

A healthcare organization uses a public cloud IaaS provider to host electronic health records (EHRs). The security team must ensure that data at rest is encrypted and that the cloud provider cannot access the plaintext. Which approach best meets this requirement?

Accepted Answer

Implement client-side encryption with customer-managed keys stored on-premises.. Client-side encryption with customer-managed keys stored on-premises ensures that the cloud provider never has access to the encryption keys or plaintext data. Provider-managed keys leave the provider with decryption capability, failing the requirement. Other options like CASB or server-side encryption do not fully prevent provider access to plaintext.

Answer

Enable server-side encryption with provider-managed keys and enforce TLS for data in transit.

Answer

Use provider-managed encryption keys with automatic rotation.

Answer

Use a cloud access security broker (CASB) to encrypt data before it reaches the cloud.