GSEC Practice Test 24 — 15 Questions

Question 1

An organization is applying CIS Control 9: Email and Web Browser Protections. They have successfully implemented domain-based message authentication (DMARC). What is the primary security goal being achieved by this implementation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prevention of unauthorized use of the organization's domain for spoofing.. DMARC is a critical component of CIS Control 9 because it builds upon SPF and DKIM to prevent email spoofing and phishing attacks. By allowing domain owners to publish instructions on how receiving servers should handle emails that fail authentication, it significantly reduces the efficacy of fraudulent emails, thereby protecting the organization's reputation and preventing users from interacting with malicious content that leverages the organization's legitimate email domain.

Answer

Encryption of email traffic between mail servers.

Answer

Hardening web browser settings to prevent XSS attacks.

Answer

Scanning of inbound email attachments for malware signatures.

Question 2

A security operations center (SOC) uses a SIEM to collect logs from various sources. The SOC manager wants to ensure that log data is retained for at least one year to meet regulatory requirements, but the SIEM's primary storage is expensive and limited. Which log management strategy should the SOC implement to meet the retention requirement cost-effectively?

Accepted Answer

Configure the SIEM to compress and archive older logs to a secondary storage tier, such as a network-attached storage (NAS) or cloud object storage, after a defined period.. The most cost-effective way to meet long-term retention is to tier storage: keep recent logs on fast, expensive primary storage and archive older logs to cheaper secondary storage. This balances performance for active investigations with compliance retention, avoiding unnecessary primary storage expansion or risky reliance on source systems.

Answer

Reduce the log retention period to 30 days and rely on the original log sources to retain their own logs for one year.

Answer

Increase the SIEM's primary storage capacity by adding more high-performance disks to accommodate one year of logs.

Answer

Disable logging for low-priority sources and keep only high-priority logs for one year on primary storage.

Question 3

What is the primary purpose of Salt in password hashing?

Accepted Answer

To prevent the use of rainbow tables. A salt is a unique, random string added to a password before it is hashed. This ensures that even if two users have the same password, their resulting hashes will be different. This prevents attackers from using pre-computed tables, such as rainbow tables, to quickly reverse the hashes of stolen passwords. By forcing attackers to calculate hashes for each individual user, the salt significantly increases the computational cost of brute-force and dictionary attacks.

Answer

To shorten the length of the stored hash

Answer

To increase the complexity of the user's password

Answer

To facilitate easier password recovery

Question 4

A hospital's wireless intrusion prevention system reports that a nearby attacker is broadcasting beacon frames that clone the SSID and BSSID of the hospital's legitimate access point at a higher signal strength, luring staff laptops to associate with the attacker's hardware. Which attack is being described, and which defense most directly addresses it?

Accepted Answer

An evil twin attack; requiring server certificate validation in the supplicant profile prevents clients from trusting the rogue AP.. Cloning an AP's SSID and BSSID with a stronger signal to attract clients is an evil twin attack. In an enterprise deployment the rogue cannot present a certificate signed by the trusted CA, so configuring the supplicant to validate the RADIUS server certificate causes the association to fail. Detection alone is weaker than preventing the trust decision.

Answer

A deauthentication flood; enabling Management Frame Protection forces the attacker's forged frames to be discarded by clients.

Answer

A MAC spoofing attack; deploying 802.1X with MAC authentication bypass on switch ports eliminates the rogue association.

Answer

A karma attack; disabling the SSID broadcast on legitimate APs prevents clients from probing for and joining the rogue device.

Question 5

A small business owner is concerned about ransomware encrypting critical files on a shared network drive. The owner wants a solution that can restore files quickly after an attack without paying the ransom. Which of the following is the MOST effective control to achieve this?

Accepted Answer

Implement a regular backup strategy that includes offline and offsite copies.. A robust backup strategy with offline and offsite copies is the most effective way to recover from ransomware. It ensures that a clean copy of data is available regardless of the attack's success. While other controls can help prevent or limit damage, only backups provide a reliable restoration path without paying the ransom.

Answer

Deploy antivirus software with real-time scanning on all endpoints.

Answer

Configure the network drive to be read-only for all users.

Answer

Enable file versioning on the shared network drive.

Question 6

A user attempts to launch a newly installed application on a macOS Monterey system, but the application fails to open with a message that it cannot be verified. The user is certain the application was downloaded from the developer's official website. Which macOS feature is responsible for this behavior?

Accepted Answer

Gatekeeper. Gatekeeper is designed to ensure that only trusted software runs on macOS. When an application is downloaded from the internet, Gatekeeper checks its code signature and notarization status. If the app is not signed with a valid Developer ID or not notarized, Gatekeeper blocks it and displays a warning. This matches the user's experience. The other features address different security aspects and would not produce this specific message.

Answer

XProtect

Answer

System Integrity Protection (SIP)

Answer

Transparency, Consent, and Control (TCC)

Question 7

A retail company's e-commerce site is being targeted by credential stuffing attacks. The security team wants to add a control that slows automated login attempts while preserving a smooth experience for legitimate customers. Which control best fits this requirement?

Accepted Answer

Deploy a CAPTCHA challenge after several failed login attempts from the same source.. Credential stuffing succeeds through automation, so the most effective layered control is one that imposes a human-verification cost after suspicious failure patterns. A CAPTCHA challenge achieves this while letting normal users proceed. Account lockout creates denial of service, hardware keys are impractical for retail customers, and geo-blocking is easily evaded and overly broad.

Answer

Block all inbound traffic from countries where the company has no customers.

Answer

Enforce a strict account lockout after three failed login attempts for all users.

Answer

Require all customers to use a hardware security key for authentication.

Question 8

A security team is implementing a new access control system for a research lab. They need to ensure that access decisions are based on the user's role and the sensitivity of the resource, and that users are only granted the minimum permissions necessary to perform their job. Which two access control principles should they apply? (Choose two.)

Accepted Answer

Principle of Least Privilege. Role-Based Access Control (RBAC) bases access decisions on the user's role, and the principle of least privilege ensures users only have the minimum permissions needed. Together, they meet the requirement to use role and resource sensitivity while enforcing least privilege. DAC, MAC, and rule-based access control do not specifically combine role-based decisions with least privilege in the same way.

Answer

Discretionary Access Control (DAC)

Answer

Rule-Based Access Control

Answer

Mandatory Access Control (MAC)

Question 9

A platform team runs a Kubernetes cluster where a container was compromised through a remote code execution flaw in a web application. The attacker attempted to read the service account token, query the API server, and list secrets in the namespace. The team wants to reduce the impact of such a compromise in the future. Which of the following changes most directly limits what the compromised pod's service account can do against the API server?

Accepted Answer

Binding a tightly scoped Role to the service account that grants only the specific verbs and resources the application requires, instead of cluster-admin or broad default permissions.. RBAC least privilege is the authoritative control over what a service account can do against the API server. Binding a narrowly scoped Role that grants only the required verbs and resources means a compromised pod's token cannot enumerate secrets or perform privileged actions, directly containing the blast radius from the RCE compromise.

Answer

Enabling audit logging on the API server to record all requests made by service accounts.

Answer

Disabling the automountServiceAccountToken field on the pod spec so no token is projected into the container.

Answer

Applying a NetworkPolicy that blocks egress from the pod to the API server's ClusterIP.

Question 10

A security analyst is examining a Kubernetes Pod specification that includes the following securityContext: runAsUser: 0. What is the security implication of this setting?

Accepted Answer

The container will run as the root user, increasing the risk of privilege escalation if compromised.. Specifying runAsUser: 0 in a Kubernetes securityContext forces the container to run as the root user. This violates the principle of least privilege and increases the potential impact of a container compromise. Best practice is to run containers as a non-root user, often defined in the image or via runAsUser with a high UID.

Answer

The container will be unable to write to any mounted volumes due to permission restrictions.

Answer

The container will run as a non-privileged user, enhancing security by default.

Answer

The container will automatically drop all Linux capabilities, reducing its attack surface.

Question 11

An assessor is standing in a parking lot outside a warehouse and needs to map the coverage footprint and identify all BSSIDs in range, including hidden networks, using a passive approach that does not associate to any AP. Which tool and technique fit this requirement?

Accepted Answer

Use Kismet in monitor mode with a supported adapter to passively capture beacon, probe response, and data frames across channels.. A passive site survey requires monitor mode so the adapter captures every frame on the channel without associating. Kismet in monitor mode reveals beacons, probe responses, and data frames, exposing BSSIDs, hidden SSIDs through client probing, channels, and encryption. This maps coverage and discovers APs while leaving the target network untouched.

Answer

Deploy a Wireshark capture on the wired uplink of the wireless controller to enumerate all BSSIDs in the coverage area.

Answer

Use Nmap with the wireless scripts enabled to enumerate BSSIDs by sending 802.11 probe requests from a managed interface.

Answer

Run airodump-ng in managed mode and associate to each detected SSID to confirm its encryption type.

Question 12

A security analyst is reviewing authentication logs and notices that an attacker attempted to log in using a list of previously breached username and password combinations. The attack failed because the organization had implemented a control that requires users to provide a second factor in addition to their password. Which type of attack was mitigated?

Accepted Answer

Credential stuffing. Credential stuffing specifically uses breached username and password pairs to gain unauthorized access. The presence of a second authentication factor prevents the attacker from succeeding even with valid credentials. Other attacks like password spraying, brute force, or rainbow tables do not rely on breached credential lists in the same way. Therefore, the mitigated attack is credential stuffing.

Answer

Rainbow table attack

Answer

Brute force

Answer

Password spraying

Question 13

A security engineer wants to ensure that container images are not modified after they are built and pushed to a registry. Which mechanism provides the strongest assurance of image integrity and authenticity?

Accepted Answer

Applying cryptographic digital signatures to container images.. Content trust and image signing using tools like Notary or Cosign ensure that the image pulled by a runtime is exactly the same one pushed by the CI/CD pipeline. By cryptographically signing the manifest, organizations prevent man-in-the-middle attacks and unauthorized registry modifications. This is vital in modern DevSecOps, as compromised images could introduce persistent backdoors or vulnerabilities into the production environment without triggering standard application-level alerts.

Answer

Implementing a read-only filesystem for the container at runtime.

Answer

Using SHA-256 image digests instead of mutable image tags.

Answer

Scanning images for known vulnerabilities using a static analyzer.

Question 14

A financial services company is aligning its security program with the CIS Critical Security Controls. The CISO asks you to identify which Implementation Group (IG) is most appropriate for a small startup with limited IT staff that handles only publicly available data and has no regulatory compliance obligations. Which IG should you recommend?

Accepted Answer

IG1. IG1 is the correct choice because it provides a foundational set of safeguards tailored to small organizations with limited resources and low-risk data. It focuses on essential cyber hygiene that addresses the most common attack vectors. For a startup with no sensitive data or regulatory requirements, IG1 offers a realistic and effective starting point without overburdening its IT staff.

Answer

IG0

Answer

IG2

Answer

IG3

Question 15

A healthcare provider is implementing CIS Control 3: Data Protection. They must ensure that data at rest is encrypted according to the safeguards. Which of the following activities directly satisfies the requirements of CIS Control 3 for data at rest?

Accepted Answer

Enabling full-disk encryption on all endpoints and servers that store protected health information.. Full-disk encryption directly satisfies the CIS Control 3 requirement to encrypt data at rest on endpoints and servers. It ensures that if a device is lost or stolen, the stored data remains unreadable. Other options address data in transit, monitoring, or physical security, which are important but do not meet the specific encryption-at-rest mandate.

Answer

Deploying a data loss prevention (DLP) solution to monitor outbound email containing patient data.

Answer

Configuring database backup files to be stored in a separate physical location with access controls.

Answer

Implementing TLS 1.2 for all web traffic to and from the electronic health record system.