GSEC Practice Exam 4 — 20 Questions

Question 1

A security administrator is reviewing the access control model used by a Windows Server 2022 domain controller. They need to ensure that when a user logs on, the system evaluates the user's group memberships and generates a data structure that is used for all subsequent access checks. Which component is responsible for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access Token. During interactive or network logon, the Local Security Authority (LSA) authenticates the user and creates an access token. This token includes the user's SID, the SIDs of all groups the user belongs to, and any privileges assigned. The token is then used by the Security Reference Monitor for all access checks against securable objects. Therefore, the access token is the correct component.

Answer

Group Policy Object (GPO)

Answer

Security Descriptor

Answer

Security Identifier (SID)

Question 2

A web developer is implementing a new session management system and wants to ensure that session cookies are not accessible via JavaScript to mitigate cross-site scripting (XSS) attacks. Which cookie attribute should be set?

Accepted Answer

HttpOnly. The HttpOnly attribute is specifically designed to prevent client-side scripts from accessing cookies. By setting HttpOnly, the cookie is protected from theft via XSS attacks that execute JavaScript in the victim's browser. The other attributes serve different purposes: Secure ensures HTTPS transmission, SameSite mitigates CSRF, and Domain controls cookie scope. Only HttpOnly directly addresses the requirement.

Answer

SameSite

Answer

Domain

Answer

Secure

Question 3

A security team is implementing a SIEM and needs to ensure that log sources are properly normalized and enriched to support effective correlation and alerting. Which TWO of the following tasks are essential for achieving this goal? (Choose two.)

Accepted Answer

Enriching events with contextual data, such as asset criticality, user identity, and geolocation, from external sources.. Normalization and enrichment are critical for SIEM effectiveness. Mapping fields to a common schema like the Splunk CIM ensures consistent field names for correlation. Enriching with context such as asset criticality and geolocation improves alert accuracy and prioritization. These two tasks together enable the SIEM to correlate events across diverse sources and generate meaningful alerts.

Answer

Configuring the SIEM to drop logs that do not match the expected format to reduce noise.

Answer

Storing all raw logs indefinitely in their original format without normalization.

Answer

Increasing the SIEM's indexing speed by disabling timestamp recognition on all logs.

Question 4

A security analyst is reviewing the update history of a Windows 10 Enterprise device managed by Windows Update for Business (WUfB). The analyst notices that a critical security update was installed 30 days after its release, even though no deferral policies were configured. Which factor is the most likely cause for the delayed installation?

Accepted Answer

The device was offline or in sleep mode during the update's initial release period.. The most likely cause is that the device was offline or inactive during the update's release. WUfB does not force immediate installation; it relies on the device being on and connected to download and install updates. Without deferral policies, updates are offered as soon as they are released, but installation depends on device availability. A 30-day delay aligns with a device that was not used or connected for an extended period, after which it received the update upon becoming active.

Answer

The device was configured to use a Windows Update for Business deferral for quality updates.

Answer

The update was blocked by a Windows Defender Application Control (WDAC) policy.

Answer

The update was not approved in Windows Server Update Services (WSUS).

Question 5

A security engineer is hardening a Windows Server 2022 environment that hosts several critical services. The engineer wants to implement measures to protect against credential theft and privilege escalation via service accounts. Which two of the following actions should the engineer take? (Choose two.)

Accepted Answer

Implement a policy to regularly audit service accounts for excessive privileges and remove unnecessary rights, such as 'Act as part of the operating system' or 'Debug programs'.. The correct actions are to deploy gMSAs for domain-authenticated services and to audit and reduce service account privileges. gMSAs provide automatic password management and reduce credential theft risk. Auditing privileges ensures least privilege and removes dangerous rights. The other options either increase risk by granting excessive privileges or weaken security through reversible encryption or overly broad logon rights.

Answer

Assign the 'Log on as a service' right to all domain users to ensure that any service can start without interruption.

Answer

Configure all services to run under the Local System account to simplify management and ensure they have the necessary privileges.

Answer

Enable the 'Store passwords using reversible encryption' policy for all service accounts to allow easy recovery of passwords if needed.

Question 6

A company uses Microsoft Entra ID (formerly Azure AD) and has a critical line-of-business application that authenticates users via SAML 2.0. The security team wants to enforce multi-factor authentication (MFA) for this application without affecting other applications. They have Entra ID P1 licenses. What is the most appropriate way to achieve this?

Accepted Answer

Configure a Conditional Access policy that targets the specific application and requires MFA for all users.. Conditional Access policies in Entra ID allow administrators to enforce MFA for specific applications and users. This is the most granular and appropriate method when you have Entra ID P1 licenses. Security defaults apply tenant-wide, the per-application MFA setting is deprecated, and authentication method policies do not enforce MFA per application. Therefore, the correct solution is to create a Conditional Access policy targeting the line-of-business application.

Answer

Set up a per-application MFA setting in the Enterprise Applications blade by enabling the 'Require multi-factor authentication' option for the specific application.

Answer

Create a new authentication method policy that restricts MFA to only the users who need access to the application.

Answer

Enable security defaults in Entra ID, which will automatically enforce MFA for all users and applications.

Question 7

When investigating a Windows system, which file system feature is responsible for recording the file metadata including timestamps for created, modified, and accessed (MACE) times?

Accepted Answer

Master File Table (MFT). The Master File Table (MFT) is the core of the NTFS file system. Every file on an NTFS volume has at least one entry in the MFT. These entries contain the MACE times, which are critical for building a timeline of events. If these times are altered, it often indicates anti-forensic activity, making the MFT the primary source for verifying file history and integrity during an investigation.

Answer

Registry hives

Answer

Event Logs

Answer

Prefetch files

Question 8

A security analyst is investigating a macOS Monterey system that may have been compromised. The analyst wants to check for signs of malicious kernel extensions. Which TWO of the following commands or tools are most appropriate for this task? (Choose two.)

Accepted Answer

kmutil showloaded. To check for malicious kernel extensions, an analyst should use tools that list loaded kexts. The kextstat command provides a list of loaded kernel extensions, while kmutil showloaded offers similar information with more detail. Both are appropriate for identifying unauthorized kexts. The other commands focus on system extensions, SIP status, or Gatekeeper assessments, which do not directly reveal loaded kernel extensions.

Answer

spctl --assess --verbose

Answer

systemextensionsctl list

Answer

csrutil status

Question 9

A security analyst is reviewing file server permissions and notices that a user, Elena, has the 'Modify' permission on a folder via group membership in 'Project_X', but she is also a member of the 'Contractors' group, which has an explicit 'Deny' for 'Write'. Elena reports she cannot edit any files in the folder. What is the most likely explanation for this behavior?

Accepted Answer

The 'Deny' permission for the 'Contractors' group takes precedence over the 'Allow' permission inherited from 'Project_X'.. Windows access control evaluates Deny entries before Allow entries. An explicit Deny for a group applies to all its members, and it overrides any Allow permissions, even those granted through other group memberships or inheritance. Thus, Elena's Write access is blocked by the Deny on the Contractors group, despite her Modify permission from Project_X.

Answer

The 'Deny' permission only applies if Elena is directly listed, not via group membership.

Answer

The 'Write' permission is not included in the 'Modify' permission, so the Deny for Write does not affect Modify.

Answer

The 'Modify' permission from 'Project_X' is inherited and therefore is overridden by the explicit 'Deny'.

Question 10

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Accepted Answer

Resetting compromised user passwords. Eradication aims to completely remove the adversary's presence. Simply deleting a file is rarely sufficient; attackers often leave multiple persistence mechanisms or backdoors. By resetting credentials, patching the underlying vulnerability, and re-imaging systems, the organization ensures that the attacker cannot easily return, effectively closing the window of opportunity that allowed the initial unauthorized access to occur and persist.

Answer

Analyzing the memory dump for malware signatures

Answer

Drafting an incident report for executive leadership

Question 11

Refer to the exhibit. An administrator applies this policy to a Windows workstation. What is the expected behavior for a user attempting to execute a legitimate application installed in their AppData folder?

Accepted Answer

The application will be blocked from execution.. The policy explicitly defines a 'Deny' rule for the AppData directory. Since the policy mode is set to 'Enforce', the endpoint security engine will block any executable residing in that path. This is a common security practice to prevent the execution of malicious payloads frequently dropped into temporary user directories, though it may inadvertently block legitimate software that installs to the user profile instead of Program Files.

Answer

The application will run normally because AppData is a standard location.

Answer

The application will run, but the activity will be logged for review.

Answer

The system will automatically move the application to Program Files.

Question 12

A security administrator is troubleshooting access issues on a Windows file server. A user, Bob, is a member of the 'Sales' group, which has 'Read & Execute' on a folder. Bob is also a member of the 'Managers' group, which has 'Full Control' on the same folder. However, Bob cannot delete files. What is the most likely cause?

Accepted Answer

The 'Sales' group has an explicit 'Deny' for 'Delete' that overrides the 'Full Control' from 'Managers'.. In Windows ACLs, an explicit Deny entry overrides any Allow permissions, regardless of the source. If the Sales group has a Deny for Delete, Bob's membership in that group triggers the Deny, preventing deletion even though Managers grants Full Control. This is the most plausible explanation given the information.

Answer

The 'Full Control' permission from 'Managers' does not include the 'Delete' permission.

Answer

Bob's user account has an explicit 'Deny' for 'Delete' that is inherited from the parent folder.

Answer

The 'Read & Execute' permission from 'Sales' is more restrictive and overrides the 'Full Control' from 'Managers'.

Question 13

A hospital's billing server runs Windows Server 2019 and stores insurance claim data. The security team wants to add a control that will detect unauthorized modification of the claim files even if an attacker gains administrative access to the operating system. Which control best meets this requirement?

Accepted Answer

Implement file integrity monitoring (FIM) using SHA-256 hashes of the claim files and schedule regular baseline comparisons.. Detecting unauthorized modification of stored data requires a mechanism that can prove whether contents changed, regardless of the attacker's privilege level. Hash-based file integrity monitoring establishes a trusted baseline and alerts on any deviation, which is exactly what the hospital needs. Encryption and auditing address confidentiality and visibility respectively, and neither produces cryptographic evidence of tampering.

Answer

Configure Windows Audit Policy to log all file access events to the Security event log.

Answer

Enable Windows BitLocker full-disk encryption on the billing server's data volume.

Answer

Deploy a host-based intrusion prevention system (HIPS) that blocks suspicious process execution on the billing server.

Question 14

A security analyst is reviewing a network diagram and sees a device placed between the internet edge router and the internal firewall. The device is described as providing network address translation and stateful connection tracking but not deep application inspection. Which device type is most consistent with this description?

Accepted Answer

A stateful firewall that tracks TCP sessions and allows return traffic for established connections.. Stateful connection tracking and network address translation are core functions of a traditional stateful firewall, which maintains a session table and allows return traffic for established flows. The scenario explicitly excludes deep application inspection, ruling out a next-generation firewall. Stateless filtering lacks connection state, and a web proxy is application-specific rather than a general stateful gateway, so the stateful firewall is the correct device type.

Answer

A stateless packet-filtering router that evaluates each packet independently against ACLs.

Answer

A next-generation firewall that performs full application-layer inspection and user identity mapping.

Answer

A web proxy that terminates HTTP and HTTPS connections and enforces content policies.

Question 15

Which of the following describes the 'Principle of Least Privilege' in an access control context?

Accepted Answer

Providing users only the access required to complete their tasks. The Principle of Least Privilege (PoLP) mandates that users should only be granted the minimum level of access necessary to perform their job functions. This minimizes the attack surface; if a user account is compromised, the potential damage is restricted to the limited permissions assigned to that account. This is a fundamental security concept for preventing lateral movement and privilege escalation during an active incident or breach.

Answer

Granting all employees access to the root directory for troubleshooting

Answer

Using the same shared password for all administrative accounts

Answer

Ensuring all users have administrator rights for software updates

Question 16

A security team is designing a resilient perimeter architecture to protect internal services from distributed denial of service attacks and web application exploits. Which THREE architectural components must be incorporated into this design? (Choose THREE)

Accepted Answer

A dedicated web application firewall to inspect HTTP and HTTPS traffic for application-layer vulnerabilities and injection attacks.. A robust perimeter defense requires multiple layers of inspection and mitigation. Web application firewalls inspect application-layer HTTP and HTTPS traffic to block injection attacks, hardware DDoS mitigation scrubbing centers absorb volumetric network floods upstream, and redundant boundary firewalls enforce stateful perimeter access control policies while eliminating single points of failure.

Answer

Unmanaged Layer-1 hubs placed directly outside the perimeter firewall to mirror raw traffic into analysis buffers.

Answer

Disabling all stateful inspection engines on perimeter firewalls to maximize throughput for inbound HTTPS sessions.

Question 17

Which THREE of the following are examples of how network segmentation supports the principle of defense in depth?

Accepted Answer

It restricts lateral movement for an attacker who has compromised a device.. Network segmentation breaks a flat network into smaller, isolated subnets. This limits the blast radius of a breach by preventing lateral movement, restricting access to sensitive data, and providing points to inspect traffic between zones. By enforcing boundaries, the organization ensures that an attacker who compromises a workstation in one zone cannot easily pivot to critical servers in another, thus creating multiple functional barriers that the attacker must overcome to reach the high-value targets.

Answer

It eliminates the need for host-based firewalls on individual servers.

Answer

It automatically encrypts all data in transit between segments.

Question 18

Which concept describes the use of security controls that operate at the perimeter, network, host, application, and data layers to protect an organization?

Accepted Answer

Defense in Depth. This approach is the definition of defense in depth, which utilizes multiple layers of security across the entire IT stack. By distributing controls across these distinct layers, an organization ensures that there are multiple obstacles between an attacker and the sensitive data. This holistic coverage is essential because attackers often use multi-stage campaigns, and having defenses at every level allows for detection and interception at different phases of the attack lifecycle.

Answer

Zero Trust Architecture

Answer

Security Information and Event Management (SIEM)

Answer

Privileged Access Management (PAM)

Question 19

Which TWO of the following are primary objectives of implementing a defense in depth strategy in a corporate environment?

Accepted Answer

To increase the difficulty and cost for an attacker to succeed.. Defense in depth aims to delay attackers, increase the probability of detection, and ensure that a single point of failure does not lead to a total security compromise. These objectives are achieved by creating layers that require an attacker to defeat multiple, distinct security measures. This approach is essential for modern enterprises where perimeter defenses can be bypassed via phishing or zero-day vulnerabilities, making internal detection and mitigation capabilities absolutely vital.

Answer

To eliminate the need for regular security patching.

Answer

To replace the requirement for user security awareness training.

Answer

To centralize all logs into a single storage location.

Question 20

When selecting a cryptographic hash function for verifying file integrity, which property is most important to ensure that an attacker cannot create two different files that produce the same hash value?

Accepted Answer

Collision resistance.. Collision resistance is the property of a hash function that makes it computationally infeasible to find two distinct inputs that result in the same output hash. This is critical for integrity verification; if an attacker could generate a malicious file with the same hash as a legitimate file, they could bypass security controls, leading to the execution of arbitrary, potentially malicious code while the system assumes the file is authentic and untampered.

Answer

Pre-image resistance.

Answer

Reversibility.

Answer

High computational speed.