GSEC Practice Test 21 — 15 Questions

Question 1

An organization implements firewalls, intrusion detection systems, and disk encryption. Which principle best describes the deployment of multiple, overlapping security controls to protect critical assets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defense in Depth. Defense in depth uses layered security to ensure that if one control fails, others remain to mitigate risk. This strategy is critical because no single security measure is foolproof against sophisticated attackers. By diversifying controls across network, host, and data layers, the organization increases the attacker's workload and reduces the probability of a successful breach, ensuring that failures in one area do not lead to a catastrophic compromise of sensitive information.

Answer

Least Privilege

Answer

Security through Obscurity

Answer

Fail-Safe Defaults

Question 2

During a forensic investigation of a compromised web application server, a security analyst discovers that outbound administrative traffic is flowing over unexpected ports and non-standard protocols. Which security architecture control should have been implemented at the network perimeter to restrict this unauthorized outbound communication?

Accepted Answer

Enforcing strict Egress Filtering policies on internal router and firewall interfaces.. Egress filtering inspects and restricts outbound traffic leaving the internal network to ensure only authorized business protocols and ports can traverse the perimeter. Implementing strict egress filtering prevents compromised hosts from communicating with external command-and-control servers or exfiltrating data via unauthorized ports.

Answer

Deploying a traditional static packet-filtering firewall with inbound rule sets.

Answer

Configuring port security on all access layer switch ports to limit MAC addresses.

Answer

Implementing WPA3 Enterprise wireless security across all corporate access points.

Question 3

An enterprise network administrator needs to isolate a new public-facing web application so that a compromise of the web server does not immediately expose the internal corporate database and directory services. Which network architecture design pattern provides the most effective defense for this scenario?

Accepted Answer

Configuring a demilitarized zone (DMZ) flanked by firewalls to separate public-facing web assets from internal network resources.. Deploying a demilitarized zone (DMZ) creates a buffered network segment between the untrusted public internet and the trusted internal corporate network. By placing the web server in the DMZ and utilizing firewalls to restrict inbound and outbound traffic flows, administrators successfully contain potential breaches. This defensive architecture stops attackers from pivoting directly into sensitive internal resources following an initial web application compromise.

Answer

Deploying the web server on the internal corporate VLAN alongside domain controllers to streamline administrative access and reduce network latency.

Answer

Implementing a flat network topology utilizing unmanaged switches to maximize throughput and simplify routing tables for incoming web traffic.

Answer

Connecting the web server directly to the outer provider edge router via a public bridge to bypass internal switching bottlenecks.

Question 4

A system administrator needs to harden a public-facing Linux server against automated brute-force attacks. Which configuration change in the /etc/ssh/sshd_config file provides the most significant reduction in the attack surface regarding credential stuffing?

Accepted Answer

PasswordAuthentication no. Securing the Secure Shell daemon is a foundational step in Linux hardening, especially for internet-accessible systems. While multiple settings contribute to a defense-in-depth strategy, moving away from knowledge-based authentication to key-based authentication represents the single most impactful change. This reduces the attack surface by requiring a digital token that cannot be guessed or easily intercepted via network sniffing techniques.

Answer

PermitRootLogin no

Answer

MaxAuthTries 3

Answer

AllowUsers admin

Question 5

A security analyst receives an alert that a workstation's antivirus detected and quarantined a known trojan. The endpoint is still running and the user reports no unusual behavior. According to the SANS six-step incident handling process, which phase is the analyst currently in?

Accepted Answer

Identification. The SANS incident handling process begins with Preparation, followed by Identification, Containment, Eradication, Recovery, and Lessons Learned. When an alert fires and an analyst validates that a genuine security event has occurred, the activity maps to Identification. No containment, eradication, or recovery actions have been described, so the scenario sits squarely in the Identification phase.

Answer

Eradication

Answer

Containment

Answer

Recovery

Question 6

A security analyst is investigating a compromised Linux server and wants to examine the environment variables of a running process with PID 1234 to identify potential injected malicious variables. Which command will display the environment of that specific process?

Accepted Answer

cat /proc/1234/environ. To inspect the environment of a running process, the analyst can read /proc/PID/environ. This pseudo-file contains the environment variables as a null-delimited string, reflecting the process's initial environment. Tools like ps and lsof provide other process details but not environment. The env command only shows the current shell's environment. Thus, accessing /proc/1234/environ is the correct approach.

Answer

ps aux | grep 1234

Answer

env

Answer

lsof -p 1234

Question 7

A small business wants to segment its flat network so that guest Wi-Fi users cannot reach internal file servers. The administrator has a Layer 2 switch that supports VLANs and a router that supports access control lists. Which combination best enforces the segmentation requirement?

Accepted Answer

Create separate VLANs for guest and internal users, and apply an ACL on the router interface that blocks traffic from the guest VLAN to the internal VLAN.. Segmenting guest and internal users into separate VLANs creates distinct Layer 2 domains, and because traffic between them must be routed, an ACL on the router interface can block guest-to-internal access. This is the most direct and reliable way to enforce the requirement with the described equipment. Same-VLAN addressing, Layer 2 hardening features, and private VLANs either do not enforce the policy or are more complex and less certain for this specific goal.

Answer

Enable private VLANs on the switch so that guest ports can communicate only with the router port.

Answer

Configure port security on all switch ports to limit the number of MAC addresses, and enable DHCP snooping on the guest VLAN.

Answer

Place guest users on the same VLAN as internal users but assign them static IP addresses in a different subnet range.

Question 8

A security team is deploying a new internal TLS certificate authority (CA) for service-to-service authentication. The CA private key must be protected, and the team wants to ensure that if the key is compromised, the attacker cannot forge certificates without detection. Which of the following is the MOST effective control to detect unauthorized certificate issuance?

Accepted Answer

Publish all issued certificates to an internal Certificate Transparency (CT) log.. Certificate Transparency logs create a verifiable record of all certificates issued by a CA. By publishing internal certificates to a CT log, the team can monitor for unexpected entries, which would indicate unauthorized issuance. This detective control is more effective than preventive measures like key size or pinning, which do not alert on forgery.

Answer

Enforce a minimum RSA key size of 4096 bits for the CA key pair.

Answer

Require Certificate Revocation List (CRL) checking on all clients.

Answer

Configure certificate pinning in all client applications.

Question 9

A security administrator is hardening a Windows Server 2022 that runs several critical services. The administrator wants to reduce the attack surface by restricting service permissions and ensuring that only authorized users can start, stop, or reconfigure services. Which TWO of the following actions should the administrator take? (Choose two.)

Accepted Answer

Use the SC command to set the service's security descriptor with a restricted DACL that grants only necessary permissions to specific groups.. To harden service permissions, the administrator should restrict the service's DACL using sc.exe sdset and disable unnecessary services via GPO. These actions limit who can control services and eliminate unneeded attack vectors. Granting broad permissions or running as Local System would weaken security, and changing recovery options does not address permissions.

Answer

Use the Services MMC snap-in to set each service's recovery options to 'Take No Action' on failure.

Answer

Configure the service to log on as the Local System account to ensure it has all necessary privileges.

Answer

Grant the 'Everyone' group the right to start and stop services to simplify management.

Question 10

A financial services firm has implemented all 18 CIS Critical Security Controls at Implementation Group 2. During a board presentation, the CISO is asked how the organization should measure the effectiveness of its security program. Which of the following best describes the role of Implementation Groups within the CIS Controls framework?

Accepted Answer

Implementation Groups are prioritized sets of safeguards tailored to an organization's risk profile and resources, with IG1 being foundational, IG2 for organizations with moderate risk, and IG3 for high-risk environments.. Implementation Groups provide a risk-based approach to adopting the CIS Controls. They help organizations prioritize safeguards according to their specific risk profile and resources, rather than a one-size-fits-all model. IG1 is foundational for all, IG2 adds for moderate risk, and IG3 for high-risk. This allows the firm to measure effectiveness by assessing implementation of the relevant safeguards within its chosen IG.

Answer

Implementation Groups are used exclusively by small businesses, while large enterprises must implement all 18 controls regardless of risk.

Answer

Implementation Groups are optional certifications that an organization can obtain to demonstrate compliance with the CIS Controls.

Answer

Implementation Groups are maturity levels that an organization must sequentially achieve, with IG1 being the lowest and IG3 the highest.

Question 11

Which of the following describes the primary goal of using a 'Honeytoken' in an environment to mitigate malicious code and insider threats?

Accepted Answer

To serve as a decoy for detecting unauthorized access.. Honeytokens are fake credentials, files, or data entries planted in a system to act as a tripwire. Because no legitimate user or process should ever access these items, any attempt to use or read them provides a high-fidelity alert of malicious activity. This strategy is highly effective for detecting lateral movement, data exfiltration attempts, or credential harvesting by malware that is already inside the perimeter and searching for targets.

Answer

To automatically patch vulnerabilities in real-time.

Answer

To encrypt sensitive data for long-term storage.

Answer

To provide a secure sandbox for testing malware.

Question 12

A security analyst needs to capture raw packet data from a high-speed core switch to analyze suspicious east-west traffic movements without interrupting production data flows. Which device feature should be configured on the switch?

Accepted Answer

Switched Port Analyzer (SPAN) or port mirroring. A Switched Port Analyzer (SPAN), also known as port mirroring, duplicates ingress and egress traffic from specified source ports or VLANs and forwards the copied frames to a dedicated monitoring port connected to a packet analyzer or intrusion detection sensor without disrupting production flows.

Answer

Network Address Translation (NAT) overloading

Answer

Virtual Router Redundancy Protocol (VRRP) failover

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Question 13

Which endpoint hardening technique is most effective at preventing unauthorized code execution by restricting the environment to only pre-approved software?

Accepted Answer

Implementing an application allowlisting solution.. Allowlisting, or application control, is the most robust method for preventing unknown or unauthorized code execution. By only allowing known, trusted binaries to run, it mitigates the risk of malware, even zero-day exploits, since the malicious code will not be on the approved list. This is a foundational strategy for high-security environments where the risk of execution must be strictly minimized.

Answer

Disabling local administrator accounts for standard users.

Answer

Enabling real-time scanning in antivirus software.

Answer

Configuring the firewall to block all inbound traffic.

Question 14

During an investigation, an analyst finds that a compromised host has an outbound connection to a known command-and-control IP every 60 seconds. The host is on a production VLAN with other servers. Which containment strategy best limits the adversary's access while preserving evidence for later analysis?

Accepted Answer

Isolate the host using network access control or an EDR network containment feature, keeping it powered on for memory capture.. Effective containment must both stop the adversary's access and preserve evidence for later analysis. Isolating the host through NAC or EDR network containment severs the C2 channel and prevents lateral movement across the production VLAN while leaving the system powered on, so volatile memory and active connections can still be captured. This balances operational risk with forensic integrity.

Answer

Immediately power off the host to sever the C2 channel and prevent further data exfiltration.

Answer

Change the host's IP address and update DNS records to redirect the adversary to a honeypot.

Answer

Block the C2 IP at the perimeter firewall and leave the host online to observe further adversary behavior.

Question 15

A security analyst is reviewing a Windows endpoint that is suspected to be compromised with a fileless malware infection. The malware is believed to have injected malicious code into a legitimate process. Which Windows tool should the analyst use to inspect the memory of running processes for signs of injection?

Accepted Answer

Process Explorer. Process Explorer provides in-depth process information, including loaded DLLs and memory contents, allowing analysts to spot suspicious or unsigned modules indicative of code injection. Task Manager, Event Viewer, and Resource Monitor lack the ability to inspect process memory in detail. Thus, Process Explorer is the correct tool for this scenario.

Answer

Resource Monitor

Answer

Task Manager

Answer

Event Viewer