GSEC Practice Test 23 — 15 Questions

Question 1

You are a security administrator for a Windows environment. You need to audit changes to critical files on a file server to detect unauthorized modifications. You decide to use Windows auditing features. Which TWO of the following steps must you perform to enable and capture file modification events? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a System Access Control List (SACL) on the files to be monitored.. To audit file modifications, you must first enable the 'Audit object access' policy, which allows the system to log access attempts. Then, you must set a SACL on each file or folder to specify what to audit. Only with both steps will Event ID 4663 (an attempt was made to access an object) be logged for modifications. The other options do not enable file auditing.

Answer

Set up a Windows Management Instrumentation (WMI) event subscription to monitor file changes.

Answer

Enable the 'Audit process tracking' policy.

Answer

Configure a Discretionary Access Control List (DACL) to deny write access to all users.

Question 2

A security engineer is implementing a digital signature solution using RSA. The engineer must ensure that signatures provide authenticity, integrity, and non-repudiation. Which TWO of the following practices are essential to achieve these goals? (Choose two.)

Accepted Answer

Hash the message with a collision-resistant hash function before signing.. To create a digital signature with RSA, the sender must hash the message using a collision-resistant hash function and then sign that hash with their private key. This provides integrity (via the hash), authenticity and non-repudiation (via the private key signature). The recipient can verify by hashing the message and decrypting the signature with the sender's public key.

Answer

Include a timestamp from a trusted Time Stamping Authority (TSA) in the signature.

Answer

Use the recipient's public key to encrypt the hash before signing.

Answer

Encrypt the entire message with the sender's private key.

Question 3

A utility company must protect a SCADA network that uses proprietary Modbus/TCP communications on a segmented OT VLAN. The security team wants to block unauthorized function codes while allowing a small set of approved read operations, and it cannot tolerate latency or protocol-breaking behavior. Which control is MOST appropriate?

Accepted Answer

An industrial protocol-aware firewall or IPS module that performs deep packet inspection of Modbus/TCP function codes.. Enforcing an allowlist of Modbus/TCP function codes requires inspecting the protocol payload, which only a control-system-aware firewall or IPS can do reliably. Port-based filtering cannot separate reads from writes because all Modbus/TCP operations share the same transport port.

Answer

A web application firewall placed in front of the SCADA historian's HTTP interface.

Answer

An email and web gateway performing TLS interception on the OT VLAN.

Answer

A stateless packet filter permitting only TCP port 502 between the engineering workstation and the PLC.

Question 4

A compliance officer wants to confirm that full disk encryption is active on a MacBook so that data at rest is protected if the device is lost. Which command should the officer run to check the FileVault status?

Accepted Answer

fdesetup status. FileVault is macOS full disk encryption, and its state is queried with the fdesetup utility. Running fdesetup status returns whether encryption is on, off, or in progress, which is precisely the evidence a compliance officer needs to confirm data-at-rest protection. Other tools report unrelated security features such as SIP or Gatekeeper.

Answer

csrutil status

Answer

spctl --status

Answer

diskutil apfs list

Question 5

A security consultant is reviewing a Windows Server 2019 file server. The folder C:\Projects has a DACL that includes an entry for the group 'Contractors' with the following advanced permissions: 'List folder / read data', 'Read attributes', 'Read extended attributes', 'Read permissions', and 'Synchronize'. The consultant notices that a contractor user can open and read files in the folder but cannot create new files or modify existing ones. Which access control concept best explains this behavior?

Accepted Answer

The contractor user has been assigned the Read & execute basic permission, which includes the listed advanced permissions.. The advanced permissions listed are the components of the Read & execute basic permission. This permission allows reading and executing files but not writing or modifying them. The contractor's inability to create or modify files is directly explained by this permission set, which is commonly used for read-only access.

Answer

The contractor user has the 'Modify' permission, but a Deny entry for 'Write' is present.

Answer

The contractor user is a member of the 'Users' group, which has the Read & execute permission by default.

Answer

The contractor user has been assigned the Write basic permission, but inheritance is blocked on the folder.

Question 6

A GSEC candidate is reviewing a Docker Compose file for a web application. The file includes a service definition that mounts the Docker socket into the container. What is the primary security risk of this configuration?

Accepted Answer

It allows the container to access the host's Docker daemon, enabling privilege escalation and full host compromise.. Mounting the Docker socket into a container effectively gives that container root-level control over the host's Docker daemon. An attacker who compromises the container can use the Docker API to start privileged containers, mount host directories, or execute commands on the host, resulting in full system compromise. This is a critical misconfiguration that should be avoided.

Answer

It prevents the container from writing to its own filesystem, causing application failures.

Answer

It exposes the container's internal ports to the host network, increasing the attack surface.

Answer

It allows the container to bypass network policies and communicate with other containers without restriction.

Question 7

Which THREE of the following represent critical log sources that should be ingested into a SIEM for effective network-wide security visibility? (Choose three)

Accepted Answer

Firewall logs. Effective SIEM visibility requires a diverse set of data sources to correlate activities across the infrastructure. Combining endpoint, network, and identity logs allows for comprehensive monitoring. These sources provide the raw telemetry necessary for detecting lateral movement, command-and-control communication, and unauthorized privilege escalation. Without this breadth of information, security teams are likely to miss the early indicators of a sophisticated attack transitioning through different segments of the enterprise network.

Answer

Local printer spooler temporary files

Answer

Office document metadata templates

Question 8

A security administrator is configuring a screened subnet (DMZ) firewall rule set. The organization wants to allow external users to reach a public web server on TCP 443 while preventing the web server from initiating connections back into the internal network. Which rule set BEST enforces this requirement?

Accepted Answer

Permit any external IP to the web server on TCP 443; deny the web server to any internal IP on all ports; permit established return traffic from the web server to external clients.. A screened subnet firewall policy should permit only the specific public service, block the DMZ host from initiating connections into the internal network, and allow return traffic for established sessions. The rule set that permits external HTTPS, denies the web server to internal IPs, and permits established return traffic achieves this. Overly broad inbound rules or rules that allow inward initiation from the DMZ undermine the security boundary.

Answer

Permit any external IP to the web server on any port; deny the web server to any internal IP on all ports.

Answer

Deny all external IPs to the web server; permit the web server to any external IP on TCP 443.

Answer

Permit any external IP to the web server on TCP 443; permit the web server to any internal IP on TCP 443 only.

Question 9

A small business wants to protect its Windows endpoints from malware delivered through email attachments and malicious websites. The owner asks a security consultant for a single built-in Windows feature that can provide real-time antivirus scanning, cloud-based protection, and automatic updates without purchasing third-party software. Which Windows feature should the consultant recommend?

Accepted Answer

Microsoft Defender Antivirus. Microsoft Defender Antivirus is the correct built-in Windows feature because it delivers real-time antivirus scanning, cloud-based protection, and automatic updates without additional cost. It covers files, email attachments, and web downloads, and it is managed through Windows Security, making it the single feature that satisfies the small business's malware protection needs.

Answer

BitLocker Drive Encryption

Answer

Windows Information Protection (WIP)

Answer

Windows Defender Firewall

Question 10

A security analyst is reviewing a web application that allows users to upload profile pictures. The application accepts files with .jpg and .png extensions, but the analyst discovers that an attacker can upload a file named 'avatar.php.jpg' and then access it directly via a URL. The server executes the file as PHP. Which security control would most directly prevent this type of attack?

Accepted Answer

Store uploaded files outside the web root and serve them via a handler that validates file content.. The vulnerability arises because the server executes uploaded files based on their extension or content. Storing files outside the web root and serving them through a validating handler prevents direct execution and ensures only safe content is delivered. This approach directly addresses the root cause, whereas other controls like CSP, HTTPS, or cookie flags do not stop server-side code execution.

Answer

Implement a strict Content Security Policy (CSP) that disallows inline scripts.

Answer

Enforce HTTPS for all upload and download requests to prevent man-in-the-middle attacks.

Answer

Set the 'secure' attribute on session cookies to ensure they are only sent over encrypted connections.

Question 11

A financial services company runs sensitive workloads on a Type 1 hypervisor. The security team wants to detect if a guest VM attempts to escape and directly access the hypervisor's memory. Which virtualization-specific security control should they implement?

Accepted Answer

Hypervisor introspection. Hypervisor introspection is specifically designed to monitor guest VM memory and state from the hypervisor level, enabling detection of escape attempts. Other controls like virtual firewalls or guest-based HIDS operate at different layers and cannot observe the hypervisor-guest boundary. For detecting direct hypervisor memory access by a guest, introspection is the appropriate virtualization-specific control.

Answer

Host-based intrusion detection system (HIDS) on each guest

Answer

Virtual firewall

Answer

Security information and event management (SIEM) correlation

Question 12

When analyzing Windows event logs to detect brute-force activity, which Event ID indicates a failed logon attempt?

Accepted Answer

Event ID 4625. Event ID 4625 is the standard Windows Security log identifier for a failed logon. Monitoring this ID is essential for identifying brute-force or credential-stuffing attacks. By correlating these logs across multiple systems, security teams can detect patterns of malicious behavior, allowing for automated account lockouts or IP blocking, which are critical components of an effective incident response strategy for Windows infrastructure.

Answer

Event ID 4624

Answer

Event ID 4740

Answer

Event ID 4768

Question 13

Refer to the exhibit. An analyst observes the provided log output. What is the most likely security incident occurring, and what is the best immediate action?

Accepted Answer

Brute-force attack; investigate the source IP and block it if unauthorized.. The exhibit shows a rapid sequence of failed login attempts from a single internal IP address, which is indicative of a brute-force or credential-stuffing attack. Security professionals must identify this pattern quickly to prevent account compromise. The standard response involves investigating the source IP for malicious intent and blocking the traffic at the network perimeter or host level to mitigate the risk of unauthorized access to the server.

Answer

Hardware failure; replace the server network interface card immediately.

Answer

Network congestion; increase the logging frequency of the server.

Answer

User error; reset the user's password to clear the event logs.

Question 14

An examiner is analyzing a Windows 10 endpoint and finds that the user account was deleted before acquisition, but the examiner still needs to determine which files that user recently opened from a network share. The user's profile folder was also removed. Which artifact is most likely to retain this information?

Accepted Answer

The Security event log's object access auditing entries in the Security.evtx file. Object access auditing, when enabled, writes file access events to the Security event log, which is system-scoped and stored under winevt\Logs, so it survives deletion of the user account and profile. Per-user hives such as NTUSER.DAT and UsrClass.dat are removed with the profile, and SRUM records resource usage rather than file opens.

Answer

The SRUM database's Application Resource Usage table

Answer

The NTUSER.DAT hive from the deleted user's profile folder

Answer

The UsrClass.dat hive from the deleted user's profile folder

Question 15

A security team is designing a network segmentation scheme for a new data center. They want to restrict lateral movement between workloads and enforce policy based on workload identity rather than IP address. Which TWO technologies best support this goal? (Choose two.)

Accepted Answer

Microsegmentation using a software-defined overlay with workload-level policy enforcement.. Restricting lateral movement and enforcing workload-identity policy requires controls that operate on east-west traffic and understand workload context. Microsegmentation with a software-defined overlay enforces per-workload policy regardless of IP, and a next-generation firewall with identity-based rules can inspect and permit only authorized workload flows. Together they address both the segmentation and identity-policy requirements.

Answer

VLANs assigned by physical switch port with inter-VLAN routing disabled.

Answer

A perimeter firewall with rules based on source and destination IP addresses.

Answer

802.1X port-based network access control on all switch ports.