GSEC Practice Test 22 — 15 Questions

Question 1

An administrator needs to implement full disk encryption for a fleet of Windows workstations. Which algorithm provides the most robust security posture while maintaining hardware acceleration support in modern CPUs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AES-256 with XTS mode. AES-256 with XTS mode is the industry standard for disk encryption, providing high security against block manipulation attacks. Leveraging hardware-level acceleration via AES-NI instructions ensures that encryption overhead is minimized, preventing performance degradation for end users. This balance of cryptographic strength and operational efficiency is vital for protecting data at rest on mobile devices that are prone to physical theft or unauthorized access attempts.

Answer

DES with CBC mode

Answer

Blowfish with ECB mode

Answer

RSA-4096 with OAEP

Question 2

An analyst is examining a Windows 10 host suspected of being used to stage and exfiltrate data. The analyst wants to identify evidence of files that were recently opened or created by the user, and of USB mass storage devices that were previously connected. Which two artifacts should the analyst examine to address these goals? (Choose two.)

Accepted Answer

The SYSTEM hive's USBSTOR key at ControlSet001\Enum\USBSTOR. RecentDocs in NTUSER.DAT preserves recently opened documents with shell item paths, addressing the recent-file goal, while the SYSTEM hive's USBSTOR key enumerates USB mass storage devices that were previously connected. Together they cover both investigative objectives. The other artifacts either record application usage, executable metadata, or network statistics, none of which map to the stated goals.

Answer

The RecentApps key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Search

Answer

The Amcache.hve Root\File key

Answer

The SRUM database's Network Data Usage table

Question 3

A security engineer is configuring a web server to enforce secure communication and prevent man-in-the-middle attacks. The engineer wants to implement HTTP Strict Transport Security (HSTS) and ensure that it is properly deployed. Which TWO of the following are required for HSTS to be effective? (Choose two.)

Accepted Answer

The HSTS header must be served over a valid HTTPS connection with a trusted certificate.. HSTS is enabled when the server sends the Strict-Transport-Security header over a trusted HTTPS connection. The browser then enforces HTTPS for future requests. A valid certificate is necessary for the browser to accept the header. Redirects and includeSubDomains are optional enhancements, and specific TLS versions are not mandated by HSTS itself. Therefore, the required elements are the header over HTTPS and a trusted certificate.

Answer

The HSTS header must include the includeSubDomains directive to protect all subdomains.

Answer

The server must be configured to support TLS 1.2 or higher for HSTS to function.

Answer

The server must redirect all HTTP requests to HTTPS before the HSTS header is processed.

Question 4

A Linux administrator needs to identify which processes are currently consuming the most CPU resources. Which command provides an interactive, real-time view of system performance and process activity?

Accepted Answer

top. The 'top' command (or its modern alternative 'htop') is the primary utility for real-time monitoring of system resources, including CPU, memory, and running tasks. Understanding how to interpret and interact with these utilities is vital for identifying rogue processes or system bottlenecks that could indicate a malware infection or a resource-exhaustion attack, allowing administrators to terminate suspicious processes immediately using built-in command signals.

Answer

ps aux

Answer

ls -l /proc

Answer

df -h

Question 5

An analyst receives an alert that a server's CPU usage has spiked to 100% and is generating outbound traffic to a known command-and-control IP address. The server is critical for a production application. After confirming the compromise, the analyst decides to isolate the server from the network. Which incident response phase does this action fall under?

Accepted Answer

Containment. The correct answer is containment because isolating a compromised server is a direct step to limit the incident's spread and impact. Containment actions are taken immediately after detection to prevent further damage, while eradication and recovery come later. Preparation is pre-incident, and recovery restores normal operations.

Answer

Preparation

Answer

Recovery

Answer

Eradication

Question 6

A government agency is adopting a cloud service model for a new case management system that processes criminal justice information. The security architect must document which security responsibilities remain with the agency under the shared responsibility model for a Software as a Service (SaaS) deployment. (Choose two.)

Accepted Answer

Managing user identities, authentication, and access permissions within the SaaS application.. Under the shared responsibility model for SaaS, the provider secures the application, runtime, and infrastructure, while the customer owns data governance and access control. Classifying data and deciding what may be stored are data-owner duties, and managing identities, authentication, and permissions controls who can reach that data. Infrastructure patching and physical security remain with the provider.

Answer

Configuring the SaaS application's database engine parameters for optimal query performance.

Answer

Maintaining the physical security of the data center facilities where the service runs.

Answer

Patching the operating system and hypervisor that host the SaaS application.

Question 7

A developer wants to prevent sensitive cookies from being transmitted over unencrypted HTTP connections. Which cookie attribute is specifically designed to enforce this requirement?

Accepted Answer

Secure. The Secure attribute is a critical security control for web applications. When a cookie is marked as Secure, the browser will only transmit that cookie if the request is being made over an encrypted connection, such as HTTPS. This prevents session tokens or sensitive data from being intercepted in cleartext via man-in-the-middle attacks, ensuring that transport-layer security is effectively utilized for all sensitive session-based interactions.

Answer

HttpOnly

Answer

SameSite=Strict

Answer

Path=/secure

Question 8

An organization is performing a gap analysis against the CIS Controls. They find that while they have strong identity management, they fail to track the software installed on local machines, leading to 'shadow IT.' Which CIS Control should they implement to address this specific visibility gap?

Accepted Answer

CIS Control 2: Inventory and Control of Software Assets. The organization's issue involves a lack of visibility into what software is running on their endpoints, which is a classic symptom of failing CIS Control 2: Inventory and Control of Software Assets. By implementing this control, organizations can maintain an authoritative list of authorized software and detect unauthorized installations, ensuring that only approved, vetted applications exist on the network, thereby reducing the risk of malware and compliance violations.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 3: Data Protection

Answer

CIS Control 7: Continuous Vulnerability Management

Question 9

When auditing an Azure environment, you notice that a Virtual Machine is utilizing a User-Assigned Managed Identity. How does this differ from a System-Assigned Managed Identity?

Accepted Answer

User-assigned identities exist as separate, independent Azure resources.. System-assigned identities are tied directly to the lifecycle of the Azure resource (e.g., the VM is deleted, the identity is deleted). User-assigned identities exist as independent resources in Azure, allowing them to be shared across multiple resources and managed independently. This flexibility is crucial for complex architectures where multiple services need to share access permissions without creating redundant identity objects, simplifying long-term identity lifecycle management and improving security granularity.

Answer

User-assigned identities do not require Entra ID authentication.

Answer

System-assigned identities can be shared across multiple resources.

Answer

System-assigned identities provide more granular permission scopes.

Question 10

A penetration tester is planning a web application assessment for a client. The tester wants to combine automated scanning with manual techniques to maximize coverage. Which two actions are MOST appropriate to include in the plan? (Choose two.)

Accepted Answer

Perform manual testing of authentication and session management flows. A thorough web application assessment pairs automated scanning with manual techniques. Automated tools like OWASP ZAP provide broad coverage of common vulnerabilities, while manual testing of authentication and session management uncovers logic and access control flaws that scanners cannot reliably detect. The other options either address infrastructure rather than the application or introduce unnecessary risk without improving coverage.

Answer

Launch a denial-of-service test against the production application to check resilience

Answer

Use a network protocol analyzer to capture all traffic between the tester and the application

Answer

Run a full TCP port scan of the web server before testing the application

Question 11

A security analyst needs to determine which network ports are currently listening for incoming connections on a Linux server. Which command is best suited for this task?

Accepted Answer

ss -tulpn. Identifying open ports is a critical step in reducing the attack surface of a Linux server. The 'ss' (socket statistics) command is the modern, high-performance replacement for the deprecated 'netstat'. It provides detailed information about active connections, listening ports, and the associated process IDs, helping administrators quickly spot unauthorized services that might serve as entry points for malicious actors.

Answer

ifconfig -a

Answer

ping -c 5 localhost

Answer

dig @localhost

Question 12

A network engineer is deploying a new IDS sensor on a switched segment and needs it to see all unicast traffic between two hosts on the same VLAN, including traffic not addressed to the sensor. The switch supports port mirroring. Which configuration should the engineer implement?

Accepted Answer

Configure a SPAN session on the switch, designating the sensor port as the destination and the VLAN or relevant ports as the source.. On a switch, unicast frames are forwarded only out the port leading to the destination MAC, so a sensor on an ordinary access port cannot see other hosts' conversations. A SPAN session with the sensor as the destination port and the monitored ports or VLAN as the source copies those frames to the sensor. This preserves normal forwarding while giving the IDS the full traffic view it needs.

Answer

Create an EtherChannel bundle between the sensor and the switch, and enable trunking on the link.

Answer

Configure a SPAN session on the switch, designating the sensor port as the source and the monitored host ports as the destination.

Answer

Enable promiscuous mode on the sensor NIC and connect it to an access port in the same VLAN as the two hosts.

Question 13

A developer is implementing an application that stores user passwords in a database. Which THREE of the following practices are essential for ensuring the cryptographic security of these stored secrets?

Accepted Answer

Using a unique, random salt for every user. Proper password storage requires a unique salt to prevent rainbow table attacks, a high-work-factor key derivation function to slow down brute-force attempts, and a secure hashing algorithm designed for slow computation. These defenses are mandatory because standard cryptographic hashes like MD5 or SHA-256 are too fast, enabling attackers to perform trillions of guesses per second on modern hardware, making the stored hashes vulnerable to rapid offline cracking if the database is leaked.

Answer

Storing passwords using SHA-256 with no salt

Answer

Encrypting the database table with AES-128

Question 14

A security engineer at a hospital must encrypt a 40 GB database backup for archival to offsite tape. The tape library appliance has very limited CPU resources, and the engineer wants a symmetric mode that allows the archive to be decrypted in independent chunks without needing to read the entire stream first. Which cipher mode BEST satisfies these requirements?

Accepted Answer

Counter Mode (CTR). Counter Mode generates a keystream by encrypting successive counter values, so ciphertext blocks have no dependency on one another. That independence enables parallel encryption and decryption and permits retrieval of arbitrary archive segments without reading the whole stream, which matches the constrained tape appliance. CTR provides confidentiality only, so a separate integrity mechanism would be needed if tamper detection matters for the archive.

Answer

Cipher Block Chaining (CBC)

Answer

Galois/Counter Mode (GCM)

Answer

Electronic Codebook (ECB)

Question 15

A security engineer is selecting a hash function to protect stored user passwords in a new application. The threat model assumes an attacker who steals the password database and has substantial GPU resources for offline cracking. Which choice best addresses this threat?

Accepted Answer

A memory-hard password hashing function such as Argon2id with a tuned memory cost, time cost, and parallelism, plus a unique per-user salt.. Password storage needs a deliberately slow, memory-hard function so each offline guess is expensive and GPU parallelism is blunted. Argon2id with tuned parameters and unique per-user salts achieves this, whereas fast hashes, reversible encryption, and a single global secret all fail against an attacker with stolen data and strong cracking hardware.

Answer

HMAC-SHA-1 keyed with a single global application secret, because the secret prevents attackers from computing hashes without it.

Answer

SHA-256 applied twice to each password with a per-user salt, because iterating a fast hash twice doubles the attacker's work.

Answer

AES-256 in CBC mode encrypting each password with a key stored in the same database, because encryption hides the password values.