GSEC Practice Test 3 — 25 Questions

Question 1

An incident responder collects volatile data from a compromised Windows 10 workstation before pulling the power. The attacker used a custom executable that is no longer present on disk, but the responder needs to confirm which process spawned it and what child processes it created. Which artifact should the responder examine to establish this parent-child process relationship?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Sysmon Event ID 1 records in the Microsoft-Windows-Sysmon/Operational log. Sysmon's Process Create event records the image, command line, hashes, and both parent process ID and parent image for every new process, which is exactly the data needed to reconstruct a process tree after the binary is gone. Other artifacts such as Amcache, $MFT, and SRUM may show that a file existed or ran but do not preserve runtime parent-child relationships.

Answer

The SRUM database's Application Resource Usage table

Answer

The $MFT entries for the volume where the executable ran

Answer

The Amcache.hve registry hive's Root\InventoryApplicationFile key

Question 2

Refer to the exhibit. An administrator runs this command to generate a certificate signing request. Which security vulnerability is introduced by the inclusion of the -nodes flag in this command?

Accepted Answer

The private key will be stored without passphrase protection. The -nodes flag instructs OpenSSL to generate a private key without a passphrase, leaving it stored in plaintext on the file system. In a production environment, this is critical because an attacker with unauthorized read access to the server's filesystem can immediately compromise the private key. Protecting private keys with a passphrase ensures that even if files are exfiltrated, the keys remain encrypted and unusable without the secret passphrase.

Answer

The RSA key length is insufficient for modern requirements

Answer

The certificate will be self-signed and untrusted

Answer

The output file format defaults to a deprecated encoding

Question 3

A security analyst is concerned about Fileless Malware attacks. Which technique is most effective for detecting code that resides only in memory without writing files to the disk?

Accepted Answer

Enabling PowerShell Script Block Logging.. Fileless malware often uses legitimate tools like PowerShell or WMI to execute code in memory. To detect this, analysts must shift from file-based scanning to process-based monitoring. Logging PowerShell Script Block Logging (Event ID 4104) and capturing command-line arguments are essential. These logs provide visibility into the actual code being executed in memory, which is the only way to catch threats that bypass traditional signature-based disk scanners by living off the land.

Answer

Deploying a traditional antivirus signature update.

Answer

Scanning the hard drive for unauthorized startup files.

Answer

Performing integrity checks on system binaries.

Question 4

A security administrator is configuring auditd on a Linux server to meet a compliance requirement that all changes to user and group files be logged. The administrator adds a watch on /etc/passwd and /etc/group. After applying the rules, the administrator notices that modifications made using the 'vipw' and 'vigr' commands are not generating audit events, even though direct edits with a text editor are logged. Which explanation best describes why this occurs?

Accepted Answer

vipw and vigr use a temporary file and rename it over the original, so a file watch on /etc/passwd sees a different inode and misses the change.. Audit watches in auditd are bound to the inode of the target file. The vipw and vigr utilities create a temporary file and rename it over the original, so the original inode is replaced and the watch no longer covers the new file. Direct edits modify the existing inode and are logged. To reliably capture these changes, administrators should watch the containing directory or use audit rules that account for renames.

Answer

vipw and vigr run as setuid root and bypass the kernel audit subsystem entirely, so no audit rules can capture their activity.

Answer

The audit rules were not loaded because auditd requires a reboot after adding watches to /etc/passwd and /etc/group.

Answer

vipw and vigr write to /etc/shadow and /etc/gshadow instead of /etc/passwd and /etc/group, so the watches never trigger.

Question 5

A security administrator needs to block all incoming traffic to a server except for SSH (port 22) using the nftables framework. Which configuration approach best follows the principle of least privilege?

Accepted Answer

Set the default policy to DROP and add an allow rule for port 22.. Firewall management is a core skill for securing Linux systems. Moving from iptables to nftables offers more efficient rule processing and a cleaner syntax. Following the principle of least privilege in a firewall context means explicitly denying all traffic by default and only opening the specific ports necessary for business operations.

Answer

Create a rule to allow port 22 and log all other traffic.

Answer

Add a rule at the end of the chain that rejects all TCP traffic.

Answer

Set the default policy of the INPUT chain to ACCEPT.

Question 6

A security analyst is reviewing a SIEM alert indicating multiple failed VPN authentication attempts followed by a successful login from an unusual geographic location for the same user account. The analyst wants to determine if this is a compromised account or a legitimate user traveling. Which additional data source would best help the analyst make this determination?

Accepted Answer

HR system records of approved travel requests for the user.. The key question is whether the login from an unusual location is legitimate travel. HR travel records provide authoritative confirmation of approved travel, directly addressing that question. Technical logs like VPN, EDR, or firewall can show activity but do not confirm the business reason for the location. HR data is the most direct source to distinguish compromise from legitimate travel.

Answer

Firewall logs showing outbound connections from the VPN-assigned IP address.

Answer

VPN concentrator logs showing the assigned IP address and session duration for the successful login.

Answer

Endpoint detection and response (EDR) logs from the user's laptop.

Question 7

A hospital's security team wants to inspect traffic between its clinical VLAN and its guest Wi-Fi VLAN, but the network must keep forwarding packets even if the inspection appliance loses power. The appliance will be inserted transparently without changing IP addressing on either VLAN. Which deployment approach BEST satisfies these requirements?

Accepted Answer

Deploy a Layer 2 bridge running in inline mode with a hardware bypass fail-to-wire segment.. Transparent inline bridging with a hardware bypass segment keeps the appliance invisible at Layer 3 while still allowing it to enforce policy on traffic crossing between VLANs. The fail-to-wire path guarantees that clinical connectivity survives a power loss, which is the decisive requirement distinguishing this from passive monitoring or routed insertion.

Answer

Deploy the appliance as a routed hop between the two VLANs with a static route on each side.

Answer

Deploy a TAP aggregator that mirrors both VLANs to the appliance and enable fail-open on the NIC.

Answer

Deploy a SPAN port on the core switch and attach the appliance in passive monitor-only mode.

Question 8

A developer is building a container image for a Python web application. During review, a security engineer notices the Dockerfile copies a .env file containing database credentials into the image and deletes it in a later RUN instruction. The engineer explains that this pattern still leaks the credentials. Which of the following best explains why the credentials remain exposed in the final image?

Accepted Answer

Each Dockerfile instruction creates a layer, and the layer containing the .env file persists in the image history even after a later deletion.. Container images are composed of immutable layers, one per Dockerfile instruction. Removing a file in a later RUN step only records a deletion in that new layer; the bytes remain in the earlier layer and can be recovered by extracting the image. Secrets must therefore be injected at runtime via secrets management, never copied into any layer.

Answer

The .env file is recreated automatically by the base image's entrypoint at container start.

Answer

Docker automatically backs up deleted files into a hidden volume that is mounted into every container.

Answer

The .env file is cached in the Docker daemon's build cache and pushed to the registry alongside the image manifest.

Question 9

A network engineer is documenting how a workstation obtains an IPv4 address on a corporate LAN. The engineer observes the workstation broadcasting a request, receiving a unicast offer from a server, broadcasting a formal request for that address, and finally receiving an acknowledgment. The engineer must record which transport protocol and ports this address-assignment exchange uses. Which combination correctly describes the exchange?

Accepted Answer

UDP ports 67 and 68, with the server listening on 67 and the client on 68.. DHCP performs address assignment over UDP, with the server on port 67 and the client on port 68, because the client must broadcast before it possesses an address. The DORA sequence (Discover, Offer, Request, Acknowledge) matches the observed broadcast request, unicast offer, broadcast request, and acknowledgment. TCP and the other listed protocols cannot provide this broadcast-based assignment.

Answer

UDP ports 53 and 54, because the address server acts as a directory service.

Answer

ICMP type 4 and type 5 messages, because routers advertise addresses to local hosts.

Answer

TCP ports 67 and 68, because address assignment requires a reliable connection.

Question 10

An organization requires that all employee MacBook Pro devices prevent unauthorized modifications to the system kernel. Which macOS security feature should the administrator focus on to ensure that only Apple-signed code executes at the kernel level?

Accepted Answer

System Integrity Protection (SIP). System Integrity Protection (SIP) is the macOS feature designed to restrict the root user from performing actions that could compromise system integrity. By enforcing kernel-level protection, SIP prevents malicious code from injecting into system processes or modifying protected files. Understanding SIP is critical for GSEC candidates as it represents the foundational boundary between user-space applications and sensitive kernel operations, serving as a primary defense against rootkits and low-level system tampering.

Answer

FileVault 2

Answer

Gatekeeper

Answer

XProtect

Question 11

A security administrator is reviewing the access control model used by a Windows Server 2022 domain controller. They need to ensure that when a user logs on, the system evaluates the user's group memberships and generates a data structure that is used for all subsequent access checks. Which component is responsible for this?

Accepted Answer

Access Token. During interactive or network logon, the Local Security Authority (LSA) authenticates the user and creates an access token. This token includes the user's SID, the SIDs of all groups the user belongs to, and any privileges assigned. The token is then used by the Security Reference Monitor for all access checks against securable objects. Therefore, the access token is the correct component.

Answer

Group Policy Object (GPO)

Answer

Security Descriptor

Answer

Security Identifier (SID)

Question 12

A web developer is implementing a new session management system and wants to ensure that session cookies are not accessible via JavaScript to mitigate cross-site scripting (XSS) attacks. Which cookie attribute should be set?

Accepted Answer

HttpOnly. The HttpOnly attribute is specifically designed to prevent client-side scripts from accessing cookies. By setting HttpOnly, the cookie is protected from theft via XSS attacks that execute JavaScript in the victim's browser. The other attributes serve different purposes: Secure ensures HTTPS transmission, SameSite mitigates CSRF, and Domain controls cookie scope. Only HttpOnly directly addresses the requirement.

Answer

SameSite

Answer

Domain

Answer

Secure

Question 13

A security team is implementing a SIEM and needs to ensure that log sources are properly normalized and enriched to support effective correlation and alerting. Which TWO of the following tasks are essential for achieving this goal? (Choose two.)

Accepted Answer

Enriching events with contextual data, such as asset criticality, user identity, and geolocation, from external sources.. Normalization and enrichment are critical for SIEM effectiveness. Mapping fields to a common schema like the Splunk CIM ensures consistent field names for correlation. Enriching with context such as asset criticality and geolocation improves alert accuracy and prioritization. These two tasks together enable the SIEM to correlate events across diverse sources and generate meaningful alerts.

Answer

Configuring the SIEM to drop logs that do not match the expected format to reduce noise.

Answer

Storing all raw logs indefinitely in their original format without normalization.

Answer

Increasing the SIEM's indexing speed by disabling timestamp recognition on all logs.

Question 14

A security analyst is reviewing the update history of a Windows 10 Enterprise device managed by Windows Update for Business (WUfB). The analyst notices that a critical security update was installed 30 days after its release, even though no deferral policies were configured. Which factor is the most likely cause for the delayed installation?

Accepted Answer

The device was offline or in sleep mode during the update's initial release period.. The most likely cause is that the device was offline or inactive during the update's release. WUfB does not force immediate installation; it relies on the device being on and connected to download and install updates. Without deferral policies, updates are offered as soon as they are released, but installation depends on device availability. A 30-day delay aligns with a device that was not used or connected for an extended period, after which it received the update upon becoming active.

Answer

The device was configured to use a Windows Update for Business deferral for quality updates.

Answer

The update was blocked by a Windows Defender Application Control (WDAC) policy.

Answer

The update was not approved in Windows Server Update Services (WSUS).

Question 15

A security engineer is hardening a Windows Server 2022 environment that hosts several critical services. The engineer wants to implement measures to protect against credential theft and privilege escalation via service accounts. Which two of the following actions should the engineer take? (Choose two.)

Accepted Answer

Implement a policy to regularly audit service accounts for excessive privileges and remove unnecessary rights, such as 'Act as part of the operating system' or 'Debug programs'.. The correct actions are to deploy gMSAs for domain-authenticated services and to audit and reduce service account privileges. gMSAs provide automatic password management and reduce credential theft risk. Auditing privileges ensures least privilege and removes dangerous rights. The other options either increase risk by granting excessive privileges or weaken security through reversible encryption or overly broad logon rights.

Answer

Assign the 'Log on as a service' right to all domain users to ensure that any service can start without interruption.

Answer

Configure all services to run under the Local System account to simplify management and ensure they have the necessary privileges.

Answer

Enable the 'Store passwords using reversible encryption' policy for all service accounts to allow easy recovery of passwords if needed.

Question 16

A company uses Microsoft Entra ID (formerly Azure AD) and has a critical line-of-business application that authenticates users via SAML 2.0. The security team wants to enforce multi-factor authentication (MFA) for this application without affecting other applications. They have Entra ID P1 licenses. What is the most appropriate way to achieve this?

Accepted Answer

Configure a Conditional Access policy that targets the specific application and requires MFA for all users.. Conditional Access policies in Entra ID allow administrators to enforce MFA for specific applications and users. This is the most granular and appropriate method when you have Entra ID P1 licenses. Security defaults apply tenant-wide, the per-application MFA setting is deprecated, and authentication method policies do not enforce MFA per application. Therefore, the correct solution is to create a Conditional Access policy targeting the line-of-business application.

Answer

Set up a per-application MFA setting in the Enterprise Applications blade by enabling the 'Require multi-factor authentication' option for the specific application.

Answer

Create a new authentication method policy that restricts MFA to only the users who need access to the application.

Answer

Enable security defaults in Entra ID, which will automatically enforce MFA for all users and applications.

Question 17

When investigating a Windows system, which file system feature is responsible for recording the file metadata including timestamps for created, modified, and accessed (MACE) times?

Accepted Answer

Master File Table (MFT). The Master File Table (MFT) is the core of the NTFS file system. Every file on an NTFS volume has at least one entry in the MFT. These entries contain the MACE times, which are critical for building a timeline of events. If these times are altered, it often indicates anti-forensic activity, making the MFT the primary source for verifying file history and integrity during an investigation.

Answer

Registry hives

Answer

Event Logs

Answer

Prefetch files

Question 18

A security analyst is investigating a macOS Monterey system that may have been compromised. The analyst wants to check for signs of malicious kernel extensions. Which TWO of the following commands or tools are most appropriate for this task? (Choose two.)

Accepted Answer

kmutil showloaded. To check for malicious kernel extensions, an analyst should use tools that list loaded kexts. The kextstat command provides a list of loaded kernel extensions, while kmutil showloaded offers similar information with more detail. Both are appropriate for identifying unauthorized kexts. The other commands focus on system extensions, SIP status, or Gatekeeper assessments, which do not directly reveal loaded kernel extensions.

Answer

spctl --assess --verbose

Answer

systemextensionsctl list

Answer

csrutil status

Question 19

A security analyst is reviewing file server permissions and notices that a user, Elena, has the 'Modify' permission on a folder via group membership in 'Project_X', but she is also a member of the 'Contractors' group, which has an explicit 'Deny' for 'Write'. Elena reports she cannot edit any files in the folder. What is the most likely explanation for this behavior?

Accepted Answer

The 'Deny' permission for the 'Contractors' group takes precedence over the 'Allow' permission inherited from 'Project_X'.. Windows access control evaluates Deny entries before Allow entries. An explicit Deny for a group applies to all its members, and it overrides any Allow permissions, even those granted through other group memberships or inheritance. Thus, Elena's Write access is blocked by the Deny on the Contractors group, despite her Modify permission from Project_X.

Answer

The 'Deny' permission only applies if Elena is directly listed, not via group membership.

Answer

The 'Write' permission is not included in the 'Modify' permission, so the Deny for Write does not affect Modify.

Answer

The 'Modify' permission from 'Project_X' is inherited and therefore is overridden by the explicit 'Deny'.

Question 20

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Accepted Answer

Resetting compromised user passwords. Eradication aims to completely remove the adversary's presence. Simply deleting a file is rarely sufficient; attackers often leave multiple persistence mechanisms or backdoors. By resetting credentials, patching the underlying vulnerability, and re-imaging systems, the organization ensures that the attacker cannot easily return, effectively closing the window of opportunity that allowed the initial unauthorized access to occur and persist.

Answer

Analyzing the memory dump for malware signatures

Answer

Drafting an incident report for executive leadership