GSEC Practice Test 25 — 15 Questions

Question 1

A security operations center (SOC) ingests NetFlow records into its SIEM. An analyst wants to detect potential data exfiltration over the network. Which SIEM correlation strategy is most effective for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Correlate outbound traffic volume with destination IP reputation and unusual port usage, and alert on deviations from the host's historical baseline.. Data exfiltration detection benefits from behavioral baselining and multi-factor correlation. By learning each host's normal outbound traffic patterns and combining volume anomalies with destination reputation and port usage, the SIEM can flag suspicious transfers that would be missed by static thresholds or country blocks alone.

Answer

Alert when any host initiates a connection to a country that is not on an approved list.

Answer

Alert when any internal host sends more than 1 GB of data to an external IP address within an hour.

Answer

Monitor for DNS queries to known command-and-control domains and alert on any match.

Question 2

A security architect is designing a system that requires cryptographic keys to be generated, stored, and used without ever exposing the private key material to the operating system. The keys must be usable for TLS server authentication and must support high transaction volumes. Which of the following solutions BEST meets these requirements?

Accepted Answer

A Hardware Security Module (HSM) with TLS offloading capabilities.. An HSM provides a dedicated, tamper-resistant environment where private keys are generated and used without ever leaving the device. This ensures the operating system never sees the key material. HSMs are also designed for high-performance cryptographic operations, including TLS acceleration, making them ideal for high-volume server authentication.

Answer

A cloud key management service (KMS) that stores keys in a multi-tenant environment.

Answer

A software-based key store protected by a strong passphrase and file system permissions.

Answer

A Trusted Platform Module (TPM) 2.0 chip on each server.

Question 3

An organization is hardening its internal corporate network architecture to prevent unauthorized hosts from connecting to switch ports in common areas and conference rooms. Which TWO configurations should the network engineering team implement to achieve this security objective? (Choose TWO)

Accepted Answer

Enabling 802.1X port-based authentication integrated with a RADIUS server and extensible authentication protocol.. Implementing 802.1X port-based authentication forces every connecting device to authenticate against a central directory service before gaining network access. Combined with port security limits that restrict the maximum number of registered MAC addresses per switch port, organizations effectively block rogue devices and unauthorized hardware from establishing unauthorized network connections in public areas.

Answer

Configuring static routing protocols on all access layer switches to bypass dynamic route poisoning attacks.

Answer

Deploying unmanaged network hubs in conference rooms to simplify physical cable management and port density.

Answer

Disabling spanning tree protocol root guard on all core enterprise switches to accelerate topology convergence times.

Question 4

A security administrator is troubleshooting a Windows 10 Enterprise device that is not receiving feature updates from Windows Update for Business. The administrator confirms that the device is connected to the network and has the correct Windows Update for Business policies applied. The administrator suspects that a Group Policy setting is overriding the Windows Update for Business configuration. Which Group Policy setting should the administrator check first?

Accepted Answer

Do not connect to any Windows Update Internet locations.. The correct answer is 'Do not connect to any Windows Update Internet locations.' This Group Policy setting prevents the device from connecting to Windows Update or Windows Update for Business, blocking feature updates. It can override Windows Update for Business configurations by cutting off access to the update service. Other policies either do not directly block updates or are part of Windows Update for Business itself.

Answer

Turn off Automatic Updates.

Answer

Configure Automatic Updates.

Answer

Select when Feature Updates are received.

Question 5

An analyst reviewing packet captures from a corporate network sees a workstation send an ARP request for the default gateway's IP address. Within milliseconds, two different ARP replies arrive from two different MAC addresses, and the workstation begins forwarding all off-subnet traffic to the second MAC. The analyst suspects an on-path attack. Which security control would most directly prevent this specific behavior on the local segment?

Accepted Answer

Configuring Dynamic ARP Inspection with a DHCP snooping binding table. Dynamic ARP Inspection is the control specifically designed to stop forged ARP replies. By relying on the DHCP snooping binding table as its source of truth for which MAC legitimately owns which IP, the switch can drop any ARP packet whose sender information does not match an authorized binding. This blocks the attacker's spoofed reply before the workstation can poison its cache and redirect off-subnet traffic.

Answer

Enabling private VLAN edge isolation between access ports

Answer

Deploying 802.1X port-based network access control on access ports

Answer

Enabling Spanning Tree Protocol on all access switches

Question 6

Which PowerShell command is used to display the current status of advanced auditing policies on a Windows system?

Accepted Answer

auditpol /get /category:*. The 'auditpol /get /category:*' command is the standard CLI method to verify the current configuration of the Advanced Audit Policy. Unlike legacy policies, advanced policies allow for granular control over what events are logged, providing better precision for security analysis. Verifying these settings is a standard step in ensuring that the security telemetry collected aligns with the organizational compliance requirements.

Answer

Get-AuditPolicy

Answer

Get-SecurityPolicy -Advanced

Answer

Get-EventLog -List

Question 7

An enterprise network design utilizes an out-of-band management network for all core routers, firewalls, and switches. The management network is physically separated from the production data plane and uses dedicated management switches. What is the primary security advantage of this defensible architecture?

Accepted Answer

It prevents compromised production workloads from launching lateral attacks against device management planes.. An out-of-band management network isolates administrative traffic from production data flows, ensuring that an operational disruption or compromise of the data plane does not lock administrators out of their infrastructure devices. This separation prevents lateral movement from compromised user workstations directly into device management interfaces, protecting critical administrative access paths.

Answer

It completely eliminates the requirement to encrypt administrative SSH and HTTPS sessions across the network core.

Answer

It automatically accelerates routing convergence times across all enterprise boundary routers by removing administrative overhead.

Answer

It allows network operators to utilize unauthenticated cleartext telnet connections without risking confidentiality breaches.

Question 8

An organization deploys a network-based Intrusion Detection System (IDS) in passive monitoring mode on a core switch trunk link. If the IDS detects an active external command-and-control connection to an infected internal workstation, what action does the IDS take?

Accepted Answer

It generates an alert log entry and notifies security analysts via SIEM integration or SNMP traps.. A network-based IDS operates in passive monitoring mode, receiving mirrored traffic copies via a SPAN port or network tap. Because it is deployed out-of-band, it cannot inline drop packets; instead, it generates security alerts, logs events, and can trigger external response mechanisms like SNMP traps or API calls.

Answer

It automatically injects TCP reset (RST) packets into the stream to terminate the active session.

Answer

It drops the malicious packets at the interface level to protect the internal workstation from further compromise.

Answer

It dynamically updates the core switch routing table to quarantine the infected workstation into an isolated VLAN.

Question 9

A junior administrator needs to quickly identify all Windows services that are currently set to start automatically but are not running on a Windows Server 2016. Which PowerShell command should the administrator use?

Accepted Answer

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -ne 'Running'}. To find automatic services that are not running, you must filter by StartType equal to 'Automatic' and Status not equal to 'Running'. The correct command uses Where-Object with -and and -ne to capture all non-running states. This ensures you don't miss services that are paused or in transition.

Answer

Get-Service -StartType Automatic | Where-Object {$_.Status -eq 'Stopped'}

Answer

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -or $_.Status -eq 'Stopped'}

Answer

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -eq 'Stopped'}

Question 10

Which TWO of the following actions are primarily restricted by macOS System Integrity Protection (SIP)?

Accepted Answer

Modifying files within the /System directory. SIP is a crucial security layer that limits root user capabilities to prevent system-level damage. By restricting modifications to protected system directories and kernel extensions, it effectively hardens the operating system against exploitation. For GSEC professionals, identifying what SIP protects is vital for performing system audits, troubleshooting software installations, and managing secure configurations, as these restrictions often impact how security agents and administrative tools interact with the underlying OS.

Answer

Installing unsigned applications from the internet

Answer

Accessing user-defined keychain items

Answer

Encrypting the user home directory

Question 11

A hospital runs a VMware vSphere cluster with several ESXi 8 hosts. The security team discovers that an attacker who compromised one guest VM was able to read memory contents belonging to a different VM on the same host. Which vSphere setting should have been enabled to prevent this cross-VM memory disclosure at the hardware level?

Accepted Answer

Enable CPU virtualization-based security features such as AMD SEV-ES or Intel TDX for the VM.. Hardware-based confidential computing features such as AMD SEV-ES and Intel TDX encrypt VM memory so that even the hypervisor and co-resident VMs cannot read it. This directly addresses the cross-VM memory disclosure, whereas the other options address migration encryption, network segmentation, or console clipboard controls, none of which isolate physical memory between guests on the same ESXi host.

Answer

Enable Encrypted vMotion on the VMkernel adapter.

Answer

Configure a vSphere Standard Switch with VLAN tagging for each VM.

Answer

Set the VM's isolation.tools.copy.disable parameter to TRUE.

Question 12

A help desk technician is troubleshooting a user's inability to reach an internal web application by its hostname, although the application is reachable by IP address. The user's workstation is configured with a DNS server address that is reachable. Which command should the technician run first to verify name resolution from the workstation?

Accepted Answer

nslookup app.internal.example.com. Because the application is reachable by IP but not by hostname, the fault lies in name resolution rather than connectivity or routing. Querying DNS directly with nslookup tests whether the configured resolver returns the correct address or an error, which isolates the problem. Other commands either require successful resolution first or inspect unrelated local state.

Answer

netstat -an

Answer

ipconfig /all

Answer

tracert app.internal.example.com

Question 13

A multinational corporation is aligning its incident response program with the CIS Critical Security Controls. They are focusing on CIS Control 17: Incident Response Management. Which of the following activities best demonstrates the establishment of a formal incident response process as required by this control?

Accepted Answer

Establishing and maintaining a documented incident response plan that defines roles, responsibilities, and communication procedures.. CIS Control 17 requires establishing and maintaining a documented incident response plan that defines roles, responsibilities, and communication procedures. This formal documentation is the foundation of the incident response process. While tools, exercises, and designated personnel are valuable, they are not sufficient without a documented plan that guides the overall response effort.

Answer

Designating a single individual as the incident response coordinator without a formal team.

Answer

Conducting an annual tabletop exercise without updating the incident response plan based on findings.

Answer

Purchasing an incident response automation tool to streamline handling of security incidents.

Question 14

A security engineer is evaluating a container runtime for a production Kubernetes cluster. The requirement is that the runtime must not share the host kernel with containers, providing stronger isolation than standard runc-based containers. Which of the following runtimes best satisfies this requirement?

Accepted Answer

Kata Containers, which runs each pod inside a lightweight virtual machine. Kata Containers runs each pod in a lightweight virtual machine with its own guest kernel, so workloads do not share the host kernel. This hardware-virtualization-based isolation provides a stronger boundary than runc, containerd with runc, or CRI-O with SELinux, all of which share the host kernel and are therefore vulnerable to kernel-level escapes.

Answer

runc with user namespaces enabled

Answer

CRI-O with the default runtime configured for SELinux enforcement

Answer

containerd configured with the default runc shim

Question 15

An analyst is examining a Linux server suspected of compromise. The analyst runs a script that lists open network connections, running processes, and loaded kernel modules, but does not copy the binaries to external media. Which principle is the analyst applying?

Accepted Answer

Order of volatility, by collecting live system state before it changes.. The order of volatility directs responders to collect the most perishable evidence first, such as network connections, running processes, and kernel modules, before they change or disappear. By gathering this live state before copying static binaries, the analyst is prioritizing volatile data. Chain of custody, least privilege, and defense in depth address different concerns and do not describe this collection sequence.

Answer

Chain of custody, by documenting each piece of evidence collected.

Answer

Least privilege, by limiting the analyst's access to system resources.

Answer

Defense in depth, by using multiple tools to examine the system.