GSEC Practice Test 2 — 25 Questions

Question 1

A security analyst needs to ensure that sensitive data in transit between two internal servers remains confidential and authenticated. Which protocol provides the most robust security for this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IPsec. IPsec provides end-to-end security at the network layer, ensuring that all data between the two endpoints is encrypted and authenticated regardless of the underlying application. This is essential for protecting sensitive traffic within a private network from sniffing or spoofing. Implementing IPsec allows for granular control over traffic security policies, making it a standard requirement for high-security environments where network-level protection is prioritized over application-specific encryption.

Answer

Telnet

Answer

HTTP

Answer

SNMPv1

Question 2

To ensure a Linux server is protected against unauthorized physical access or boot-level modifications, which THREE security controls should be implemented?

Accepted Answer

Setting a BIOS/UEFI password. Boot security is often overlooked but is a critical component of overall system hardening. If an attacker has physical access and the boot process is not secured, they can easily bypass operating system security controls by booting into single-user mode or using a live environment to mount and modify the local filesystem.

Answer

Enabling the sticky bit on /tmp

Answer

Disabling the IPv6 network stack

Question 3

During a routine vulnerability assessment, an analyst discovers that a network router is responding to ICMP Timestamp requests. What is the primary security risk associated with enabling this service on perimeter networking equipment?

Accepted Answer

Allowing unauthorized entities to gather precise system uptime and clock synchronization data.. Responding to ICMP Timestamp requests leaks the exact system uptime and local clock settings to unauthenticated external entities. Attackers use this timing information to fingerprint operating systems, map network latency anomalies, and design precise timing attacks against time-dependent cryptographic protocols and authentication tokens.

Answer

Enabling remote attackers to execute arbitrary shell commands via buffer overflows in the ICMP daemon.

Answer

Exposing internal private IP address ranges through embedded DNS zone transfer responses.

Answer

Facilitating high-bandwidth distributed denial-of-service reflection attacks using small spoofed packets.

Question 4

A GSEC consultant is hardening a Kubernetes cluster that runs multi-tenant workloads. A developer reports that a pod in the tenants namespace was able to read the contents of the kubelet's host filesystem at /var/lib/kubelet. The pod spec includes hostPath: {path: /var/lib/kubelet, type: Directory} under volumes and mounts it at /host. The cluster has Pod Security Admission enabled with the restricted profile enforced cluster-wide, but the tenants namespace was labeled pod-security.kubernetes.io/enforce: privileged to unblock a legacy job. Which action most directly closes this exposure?

Accepted Answer

Remove the privileged label from the tenants namespace so the restricted profile is enforced there, and refactor the legacy job to run without a hostPath mount.. Pod Security Admission decides admission based on the namespace's pod-security.kubernetes.io/enforce label, and the privileged value on the tenants namespace overrode the cluster-wide restricted profile. That exemption is precisely what let a pod mount the node's /var/lib/kubelet directory via hostPath. Removing the label restores restricted enforcement, which forbids hostPath volumes, and refactoring the legacy job removes the need for the exemption so the exposure cannot be recreated.

Answer

Enable the NodeRestriction admission plugin and rotate the kubelet client certificates on all worker nodes.

Answer

Add a seccomp profile of RuntimeDefault to the pod and set allowPrivilegeEscalation to false in its securityContext.

Answer

Create an OPA Gatekeeper constraint that denies pods whose namespaces carry the privileged enforcement label.

Question 5

A security administrator is configuring a new wireless intrusion prevention system (WIPS) for a corporate campus. The administrator wants the WIPS to automatically contain an unauthorized access point that is broadcasting the corporate SSID. Which WIPS capability should be enabled to achieve this?

Accepted Answer

Rogue AP containment via over-the-air deauthentication and disassociation frames.. Automatic rogue AP containment in a WIPS works by sending deauthentication and disassociation frames to clients associated with the rogue device, preventing them from using it. This meets the requirement for automatic neutralization. Alerting, spectrum analysis, and location tracking are valuable but do not provide containment. Enabling containment is the direct action that achieves the goal.

Answer

Location tracking of wireless clients.

Answer

Wireless intrusion detection with alerting only.

Answer

Spectrum analysis to identify interference sources.

Question 6

A SIEM administrator is troubleshooting why Windows event logs forwarded from a domain controller are not being parsed correctly. The logs are sent using the Windows Event Forwarding (WEF) subscription, but the SIEM shows raw XML instead of normalized fields. The administrator confirms that the WEF subscription is active and events are arriving. Which action should the administrator take to ensure proper parsing?

Accepted Answer

Create a custom parser in the SIEM that extracts fields from the XML structure of the WEF events.. WEF forwards events in XML format. If the SIEM's collector is not configured to parse that XML, it stores raw XML and fields are not normalized. The administrator should create a custom parser that extracts relevant fields from the WEF XML schema and maps them to the SIEM's data model. Other options either do not address the parsing issue or are technically infeasible.

Answer

Install a SIEM agent on the domain controller to read the event logs directly and forward them in a normalized format.

Answer

Configure the SIEM to use the Windows Event Log collector with the correct channel names and enable XML parsing.

Answer

Modify the WEF subscription to forward events in JSON format instead of XML.

Question 7

When configuring an Active Directory (AD) environment, which functional level is required to utilize the 'Authentication Policies' feature introduced in Windows Server 2012?

Accepted Answer

Windows Server 2012. The Windows Server 2012 domain functional level introduced significant security improvements, including Authentication Policies and Silos. These allow for the restriction of account usage to specific hosts or services, effectively mitigating the risk of credential theft and lateral movement. Knowing these functional level requirements is critical for architects planning upgrades to ensure that modern security controls are available and correctly implemented across the forest.

Answer

Windows Server 2003

Answer

Windows Server 2008 R2

Answer

Windows Server 2016

Question 8

Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?

Accepted Answer

The Incident Response Plan. An Incident Response Plan (IRP) defines the procedures, roles, and communication paths required during a breach. It is essential for compliance because it dictates the timeline and requirements for notifying regulators and affected parties. Without a pre-established plan, organizations often fail to meet legal reporting deadlines, resulting in significant fines and loss of stakeholder trust, making the IRP a foundational piece of the response process.

Answer

A list of all employee hardware serial numbers

Answer

The corporate employee handbook

Answer

The server room floor plan

Question 9

A security analyst is investigating a suspected credential theft attack on a Windows 10 workstation. The analyst reviews the Security event log and sees Event ID 4648 (A logon was attempted using explicit credentials) occurring repeatedly for a service account. Which of the following best describes the significance of this event in the context of credential theft?

Accepted Answer

It indicates that the service account's credentials were used to run a process with explicit credentials, which could be a sign of pass-the-hash or credential reuse.. Event ID 4648 is generated when a logon is attempted using explicit credentials, such as with RunAs or a scheduled task. In credential theft, attackers may use stolen credentials to start processes, causing this event. Repeated occurrences for a service account can signal malicious activity. Other events like 4625, 4740, or 4672 have different meanings and are not directly indicative of explicit credential use.

Answer

It indicates that the service account was granted special privileges, such as SeDebugPrivilege, which is a common post-exploitation step.

Answer

It indicates that the service account's password was changed, which is a common persistence technique after credential theft.

Answer

It indicates that the service account was locked out due to multiple failed logon attempts, which is a sign of brute-force attack.

Question 10

Which TWO of the following statements accurately describe the characteristics of UDP compared to TCP?

Accepted Answer

UDP is faster due to the lack of a handshake.. UDP is a connectionless, datagram-oriented protocol that prioritizes speed and efficiency over reliability. It does not perform handshakes, flow control, or error correction, making it ideal for real-time applications like VoIP. TCP, conversely, provides a reliable stream by managing connections and acknowledging packet delivery. Understanding these differences is crucial for firewall configuration, as security policies must account for the stateless nature of UDP versus the stateful requirements of TCP.

Answer

UDP provides guaranteed delivery of packets.

Answer

UDP uses flow control to manage data transmission rates.

Answer

UDP is the primary protocol for HTTP web traffic.

Question 11

An organization is deploying Just-In-Time (JIT) administration. Which Windows feature provides the necessary framework for creating temporary, elevated group memberships for domain administrators?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) using Microsoft Identity Manager (MIM) allows for the creation of shadow principals in a separate forest. This approach ensures that administrative rights are only granted for a specific window of time, drastically reducing the impact of a compromised account. This is a vital architectural pattern for securing Active Directory environments against persistent threats that rely on long-lived administrative privileges to maintain access.

Answer

Restricted Groups GPO

Answer

User Rights Assignment policy

Answer

Group Policy Preferences

Question 12

A security analyst suspects an internal host is communicating with a command-and-control server using DNS tunneling. Which network protocol characteristic should the analyst examine to best identify this malicious behavior?

Accepted Answer

Unusually high frequency and elevated entropy levels within TXT or subdomain record queries.. DNS tunneling embeds arbitrary data inside standard DNS queries and responses, primarily utilizing TXT, NULL, or subdomains of A records. Analysing query length and entropy helps security professionals detect abnormal payload sizes that deviate from legitimate domain name resolution patterns, protecting enterprise networks from stealthy data exfiltration and C2 channels.

Answer

TCP connection state tables showing persistent half-open sessions on port 53.

Answer

Frequent receipt of ICMP Destination Unreachable messages indicating blocked UDP traffic.

Answer

Elevated round-trip time latency on standard HTTP GET requests traversing proxy servers.

Question 13

An incident responder notices suspicious memory usage on a protected host. Which endpoint forensic technique is most reliable for detecting file-less malware that resides only in RAM?

Accepted Answer

Performing a memory dump and analyzing it for anomalous process threads.. File-less malware operates by injecting malicious code directly into the memory space of legitimate system processes. Traditional disk-based scanning tools will miss this, as no malicious file exists on the filesystem. Detecting file-less attacks requires inspecting memory for anomalies, such as injected threads or hooked functions, which requires specialized tools capable of analyzing process memory structures in real-time.

Answer

Scanning the hard drive for known malicious file signatures.

Answer

Analyzing the Master File Table (MFT) for deleted entries.

Answer

Checking the Windows Event Logs for failed login attempts.

Question 14

Refer to the exhibit. A network administrator configured port security on a switch interface to protect against unauthorized device connections. Based on the provided configuration snippet, what action will the switch take if a third device with an unknown MAC address connects to this port?

Accepted Answer

The switch will immediately transition the interface into an error-disabled state and shut down port operations.. When port security is configured with a maximum limit of two MAC addresses and a violation mode of shutdown, the switch immediately disables the interface the moment a third unique MAC address attempts to communicate. The port enters an error-disabled state, dropping all traffic until an administrator manually resets the interface or configures an automatic recovery timer.

Answer

The switch will forward the third device's traffic while generating an alert log entry to the central syslog server without dropping packets.

Answer

The switch will drop packets originating from the third device while keeping the physical port in an active operational state.

Answer

The switch will temporarily quarantine the third device in a restricted guest VLAN while awaiting administrator approval.

Question 15

A security engineer is designing a password hashing scheme for a new application. The scheme must be resistant to GPU-accelerated cracking and allow for tuning of CPU and memory costs. Which hashing algorithm should the engineer choose?

Accepted Answer

Argon2. Argon2 is specifically designed to be memory-hard and CPU-hard, with tunable parameters for time, memory, and parallelism. This makes it resistant to GPU-accelerated cracking and allows customization for different environments. bcrypt and PBKDF2 lack memory tuning, and SHA-256 is too fast. Therefore, Argon2 is the correct choice for the password hashing scheme.

Answer

PBKDF2

Answer

bcrypt

Answer

SHA-256 with a random salt

Question 16

Which of the following is the most effective way to prevent secrets (such as API keys) from being leaked via container images?

Accepted Answer

Use orchestrator-native secret management to inject secrets at runtime.. Secrets should never be baked into container images because they remain in the image layers even if deleted in later steps. Once an image is pushed to a registry, those secrets are accessible to anyone with pull access. Using orchestrator-native secret management (like Kubernetes Secrets or Vault) ensures that sensitive data is injected at runtime, keeping it out of the persistent image layers and the source control history.

Answer

Encrypt the Dockerfile using a secret key before building.

Answer

Delete the secrets in a subsequent RUN layer during the build.

Answer

Set the file permissions on the secret to 600 after copying it.

Question 17

A security analyst is examining a web application that uses JSON Web Tokens (JWT) for authentication. The analyst captures a token and notices that the header contains "alg": "none". The analyst is concerned about the security of the application. Which of the following best describes the risk associated with this token?

Accepted Answer

The token is unsigned, allowing an attacker to modify the payload and forge valid tokens.. A JWT with "alg": "none" is unsigned, meaning it has no integrity protection. An attacker can tamper with the payload and, if the server accepts such tokens, forge arbitrary claims. This can lead to authentication bypass or privilege escalation. The correct answer identifies that the token is unsigned and can be modified. The other options mischaracterize the token as encrypted, weakly signed, or solely vulnerable to replay, missing the core issue of missing signature verification.

Answer

The token uses a weak signing algorithm that can be brute-forced to recover the secret key.

Answer

The token is vulnerable to replay attacks because it lacks an expiration claim.

Answer

The token is encrypted, so the contents cannot be read by an attacker.

Question 18

A financial services firm is aligning its security program with the CIS Critical Security Controls. The CISO wants to ensure that the organization can measure the effectiveness of its security posture over time and prioritize improvements. Which of the following should the security team implement to achieve this?

Accepted Answer

Adopt the CIS Risk Assessment Method (CIS RAM) to identify, analyze, and prioritize risks based on the CIS Controls.. CIS RAM is specifically designed to help organizations implement the CIS Controls by providing a repeatable, risk-based assessment method. It enables the security team to measure the effectiveness of controls, identify gaps, and prioritize remediation efforts. Other options, while valuable, do not offer the same direct alignment with CIS Controls for measuring and improving security posture over time.

Answer

Conduct a penetration test to identify vulnerabilities in the organization's external-facing infrastructure.

Answer

Deploy a SIEM solution to collect and correlate security events from all network devices.

Answer

Implement the NIST Cybersecurity Framework to map current activities to the five core functions.

Question 19

A security engineer is designing a secure enterprise environment and needs to deploy network intrusion detection sensors to monitor east-west traffic moving between virtual machines inside an internal virtualization cluster. Which deployment method ensures the sensors successfully inspect internal segment traffic without introducing a single point of failure for packet forwarding?

Accepted Answer

Configuring hypervisor-level distributed virtual switches to mirror east-west traffic to dedicated virtual security monitoring appliances.. Using virtual tap interfaces or distributed software switches configured for port mirroring allows security sensors to receive copies of internal traffic traversing the hypervisor backplane. This approach ensures comprehensive visibility into east-west lateral movement without altering inline packet forwarding paths, maintaining network availability while delivering the necessary telemetry for threat detection engines.

Answer

Placing a dedicated physical inline bump-in-the-wire network intrusion prevention system between every internal virtual switch uplink.

Answer

Routing all inter-VLAN traffic through a single legacy perimeter firewall using hardware router-on-a-stick configurations.

Answer

Disabling all stateful packet inspection on internal firewalls to allow maximum throughput for east-west virtualization traffic.

Question 20

A university is implementing CIS Control 6: Access Control Management. They want to ensure that user accounts are properly managed. Which of the following actions best aligns with the requirement to manage the lifecycle of user accounts?

Accepted Answer

Conducting quarterly reviews of all user accounts to identify and disable inactive accounts.. Quarterly reviews of user accounts directly support the lifecycle management requirement of CIS Control 6. By identifying and disabling inactive accounts, the university reduces the risk of unauthorized access through stale credentials. Other actions like password policies, MFA, and PAM are valuable but do not fulfill the specific need to manage account lifecycles across all users.

Answer

Implementing multi-factor authentication for all administrative access to servers.

Answer

Deploying a privileged access management (PAM) solution to vault administrative credentials.

Answer

Enforcing a password complexity policy that requires 12 characters with mixed case and symbols.