GSEC Practice Test 4 — 25 Questions

Question 1

A security team is designing a resilient perimeter architecture to protect internal services from distributed denial of service attacks and web application exploits. Which THREE architectural components must be incorporated into this design? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A dedicated web application firewall to inspect HTTP and HTTPS traffic for application-layer vulnerabilities and injection attacks.. A robust perimeter defense requires multiple layers of inspection and mitigation. Web application firewalls inspect application-layer HTTP and HTTPS traffic to block injection attacks, hardware DDoS mitigation scrubbing centers absorb volumetric network floods upstream, and redundant boundary firewalls enforce stateful perimeter access control policies while eliminating single points of failure.

Answer

Unmanaged Layer-1 hubs placed directly outside the perimeter firewall to mirror raw traffic into analysis buffers.

Answer

Disabling all stateful inspection engines on perimeter firewalls to maximize throughput for inbound HTTPS sessions.

Question 2

Which THREE of the following are examples of how network segmentation supports the principle of defense in depth?

Accepted Answer

It restricts lateral movement for an attacker who has compromised a device.. Network segmentation breaks a flat network into smaller, isolated subnets. This limits the blast radius of a breach by preventing lateral movement, restricting access to sensitive data, and providing points to inspect traffic between zones. By enforcing boundaries, the organization ensures that an attacker who compromises a workstation in one zone cannot easily pivot to critical servers in another, thus creating multiple functional barriers that the attacker must overcome to reach the high-value targets.

Answer

It eliminates the need for host-based firewalls on individual servers.

Answer

It automatically encrypts all data in transit between segments.

Question 3

Which concept describes the use of security controls that operate at the perimeter, network, host, application, and data layers to protect an organization?

Accepted Answer

Defense in Depth. This approach is the definition of defense in depth, which utilizes multiple layers of security across the entire IT stack. By distributing controls across these distinct layers, an organization ensures that there are multiple obstacles between an attacker and the sensitive data. This holistic coverage is essential because attackers often use multi-stage campaigns, and having defenses at every level allows for detection and interception at different phases of the attack lifecycle.

Answer

Zero Trust Architecture

Answer

Security Information and Event Management (SIEM)

Answer

Privileged Access Management (PAM)

Question 4

Which TWO of the following are primary objectives of implementing a defense in depth strategy in a corporate environment?

Accepted Answer

To increase the difficulty and cost for an attacker to succeed.. Defense in depth aims to delay attackers, increase the probability of detection, and ensure that a single point of failure does not lead to a total security compromise. These objectives are achieved by creating layers that require an attacker to defeat multiple, distinct security measures. This approach is essential for modern enterprises where perimeter defenses can be bypassed via phishing or zero-day vulnerabilities, making internal detection and mitigation capabilities absolutely vital.

Answer

To eliminate the need for regular security patching.

Answer

To replace the requirement for user security awareness training.

Answer

To centralize all logs into a single storage location.

Question 5

When selecting a cryptographic hash function for verifying file integrity, which property is most important to ensure that an attacker cannot create two different files that produce the same hash value?

Accepted Answer

Collision resistance.. Collision resistance is the property of a hash function that makes it computationally infeasible to find two distinct inputs that result in the same output hash. This is critical for integrity verification; if an attacker could generate a malicious file with the same hash as a legitimate file, they could bypass security controls, leading to the execution of arbitrary, potentially malicious code while the system assumes the file is authentic and untampered.

Answer

Pre-image resistance.

Answer

Reversibility.

Answer

High computational speed.

Question 6

A security administrator needs to ensure that a newly created script, 'cleanup.sh', can only be executed by the file owner, while preventing any other users from reading or writing the file. Which command achieves this configuration?

Accepted Answer

chmod 700 cleanup.sh. The chmod command with the octal value 700 applies read, write, and execute permissions exclusively to the owner (7), while setting no permissions for the group (0) and others (0). This follows the principle of least privilege by isolating the script's execution to the authorized user. Restricting access is critical in Linux security to prevent unauthorized execution of potentially sensitive maintenance utilities by standard users or attackers.

Answer

chmod 777 cleanup.sh

Answer

chmod 755 cleanup.sh

Answer

chmod 600 cleanup.sh

Question 7

When configuring endpoint security, which THREE of the following are considered 'defense-in-depth' measures to protect against ransomware?

Accepted Answer

Applying the Principle of Least Privilege (PoLP) to user file shares.. Defense-in-depth requires multiple layers of security to ensure that if one control fails, others are present to mitigate the impact. For ransomware, this includes preventing the execution, limiting the scope of damage through permissions, and maintaining immutable backups. These layers ensure that an attacker must overcome multiple, diverse obstacles to achieve their objective of data encryption, significantly increasing the difficulty of a successful attack.

Answer

Disabling all network connections to the endpoint.

Answer

Enabling guest access for easier file sharing across departments.

Question 8

An administrator is reviewing system logs to identify potential unauthorized access attempts. Which TWO commands are commonly used to view the last few lines of a log file in real-time?

Accepted Answer

tail -f /var/log/auth.log. Monitoring logs in real-time is a fundamental skill for GSEC professionals to detect ongoing attacks or system errors. The 'tail -f' command is the standard utility for following a file's growth. Alternatively, 'less +F' offers a more robust interface that allows the admin to toggle between real-time monitoring and static analysis, providing better flexibility when investigating complex log entries during an active incident response scenario.

Answer

head -n 20 /var/log/auth.log

Answer

cat /var/log/auth.log | grep -v 'accepted'

Answer

more /var/log/auth.log

Question 9

Refer to the exhibit. A network administrator applies this ACL to a router interface. A user from the 192.168.1.0/24 subnet attempts to access the web server at 10.0.5.5 on port 80. What is the result of this traffic flow?

Accepted Answer

The traffic is denied because the first rule matches and terminates evaluation.. Cisco standard and extended ACLs process rules sequentially from top to bottom. The first rule explicitly denies any IP traffic to the host 10.0.5.5 on port 80. Because this deny rule is matched first, the router immediately drops the packet before evaluating subsequent lines. Even though the second rule would have permitted the traffic, it is unreachable due to the specificity and position of the initial deny statement.

Answer

The traffic is permitted because the second rule matches the source subnet.

Answer

The traffic is permitted because permit rules take precedence over deny rules.

Answer

The router generates an error because the ACL rules are contradictory.

Question 10

An administrator needs to harden a corporate switch infrastructure against unauthorized device connections and Man-in-the-Middle attacks. Which combination of Layer 2 security controls provides the most comprehensive defense against both DHCP spoofing and ARP poisoning?

Accepted Answer

Deploying Dynamic ARP Inspection paired with an active DHCP Snooping binding table.. DHCP Snooping builds a trusted binding database by intercepting DHCP messages on untrusted ports, while Dynamic ARP Inspection utilizes this database to drop forged ARP replies. Implementing both mitigates rogue DHCP servers and prevents ARP cache poisoning attacks, securing Layer 2 communications from interception and spoofing without relying solely on static configurations.

Answer

Implementing Port Security along with Static ARP entries on all critical endpoints.

Answer

Enabling BPDU Guard and Root Guard on all designated edge access ports.

Answer

Configuring VLAN Access Control Lists alongside private VLAN isolated port modes.

Question 11

You are hardening a Windows environment and must restrict the use of PowerShell to only digitally signed scripts. Which command should you execute?

Accepted Answer

Set-ExecutionPolicy AllSigned. Setting the execution policy to 'AllSigned' forces the system to verify that every script has been signed by a trusted publisher. This is a fundamental security control that prevents the execution of unauthorized or tampered scripts. Implementing this policy significantly reduces the attack surface for fileless malware that relies on unconstrained execution of PowerShell commands and scripts.

Answer

Set-ExecutionPolicy RemoteSigned

Answer

Set-ExecutionPolicy Unrestricted

Answer

Set-ExecutionPolicy Bypass

Question 12

Which component of the Windows Security Infrastructure is responsible for checking the user's token against the Security Descriptor of an object to authorize access?

Accepted Answer

Security Reference Monitor (SRM). The Security Reference Monitor (SRM) is the core component within the Windows executive that enforces security policies. It performs the critical task of Access Check, comparing the user's security token against the object's Discretionary Access Control List (DACL). Understanding this mechanism is fundamental for any security professional, as it is the final gatekeeper for every single request to access files, registry keys, or services on a Windows system.

Answer

Local Security Authority (LSA)

Answer

Security Account Manager (SAM)

Answer

Active Directory Domain Services (AD DS)

Question 13

Refer to the exhibit. Which configuration setting poses the most significant risk to the wireless network environment?

Accepted Answer

WPS enabled allows for PIN-based brute-force attacks.. The exhibit shows WPS enabled on a WPA2-PSK network. WPS is notoriously vulnerable to brute-force attacks against its 8-digit PIN, which can be cracked in hours, revealing the underlying WPA2 passphrase. Disabling WPS is a standard security requirement because the protocol's design flaw allows for efficient recovery of the network key regardless of the passphrase's complexity, rendering the PSK security model entirely ineffective.

Answer

Channel 1 selection is a performance concern.

Answer

WPA2-PSK is insufficient for modern enterprise needs.

Answer

Management Frame Protection is disabled.

Question 14

An administrator wants to prevent unauthorized modification of Windows Services. Which tool allows for the centralized management of service startup types and logon accounts across multiple domain-joined systems?

Accepted Answer

Group Policy Management Console (GPMC). Group Policy Objects (GPO) are the standard mechanism in Windows environments to enforce security configurations, including service management, across an entire fleet. Centralized control ensures that security policies are applied consistently, preventing configuration drift and unauthorized changes that could be exploited by attackers. By leveraging GPOs, administrators can maintain a hardened baseline, which is a foundational requirement for both GIAC compliance standards and general enterprise cybersecurity best practices.

Answer

Task Scheduler

Answer

Services.msc

Answer

Local Security Policy (secpol.msc)

Question 15

A security analyst is examining a web application that uses HTTP Strict Transport Security (HSTS). The analyst notices that the HSTS header is only sent on HTTPS responses and includes the 'preload' directive. Which additional measure must be taken to ensure the domain is included in browser preload lists?

Accepted Answer

Submit the domain to the HSTS preload list maintained by Google, and ensure the header includes 'includeSubDomains' and a max-age of at least one year.. To preload HSTS, the domain must meet strict criteria: the HSTS header must include 'includeSubDomains', 'preload', and a max-age of at least one year. The 'preload' directive alone does not trigger automatic inclusion; the domain must be submitted to the preload list service. Once accepted, browsers hardcode the domain, enforcing HTTPS even on the first visit. This prevents SSL stripping attacks during initial connections.

Answer

Ensure the HSTS header is sent with a max-age of at least six months and includes the 'preload' directive, then submit the domain to the preload list.

Answer

Configure the server to redirect all HTTP requests to HTTPS with a 301 status code and include the HSTS header in the redirect response.

Answer

Add the 'preload' directive to the HSTS header and wait for browsers to automatically discover and add the domain to their preload lists.

Question 16

An organization is migrating to a cloud environment and must ensure that data remains encrypted while in use by applications. Which technology should the security team implement to achieve this?

Accepted Answer

Homomorphic Encryption. Homomorphic encryption is a sophisticated cryptographic technique that allows computations to be performed on encrypted data without first needing to decrypt it. This ensures that the data is never exposed in cleartext within the application's memory or on the cloud provider's host, effectively providing security for data-in-use. This is a powerful, though performance-intensive, solution for highly regulated industries like finance or healthcare that require data protection even during processing in untrusted environments.

Answer

Transport Layer Security (TLS)

Answer

Full Disk Encryption (FDE)

Answer

Database Transparent Data Encryption

Question 17

Which password management practice best minimizes the impact of a credential stuffing attack?

Accepted Answer

Enforcing unique passwords per service. Credential stuffing relies on users reusing the same passwords across multiple services. By enforcing unique, complex passwords for every single account, users ensure that a compromise at one service does not lead to a cascade of compromises elsewhere. This is the single most effective defense against automated attacks that attempt to use leaked database dumps to gain unauthorized access to other unrelated accounts held by the same user.

Answer

Mandating password changes every 30 days

Answer

Requiring a minimum password length of 8 characters

Answer

Disabling account lockout after failed attempts

Question 18

Why does the inclusion of detective controls improve a defense in depth strategy?

Accepted Answer

They provide visibility into successful bypasses of preventive controls.. Preventive controls are not always effective against every threat; therefore, detective controls are necessary to identify breaches that successfully penetrate the perimeter. By monitoring for indicators of compromise, security teams can respond to incidents in progress. This reduces the dwell time of an attacker, preventing a minor initial compromise from escalating into a major data exfiltration event. Detective controls effectively close the loop between prevention and response in a defense in depth model.

Answer

They automatically block all malicious traffic before it reaches the network.

Answer

They remove the need for regular vulnerability assessments.

Answer

They ensure that all user actions are strictly restricted by policy.

Question 19

An organization needs to encrypt a database of PII. The requirements state that the encryption must be reversible by authorized staff and provide data integrity. Which implementation should the security engineer recommend?

Accepted Answer

Implement AES-256 in GCM mode.. Using AES-256 in GCM mode provides both confidentiality and authenticity. Symmetric encryption is appropriate for database encryption where authorized entities hold the decryption keys. GCM mode is preferred because it acts as an Authenticated Encryption with Associated Data (AEAD) algorithm, preventing unauthorized modification of the ciphertext. This is critical for database security, where verifying that data has not been tampered with is as important as preventing unauthorized disclosure of the stored information.

Answer

Use SHA-256 hashing for all database fields.

Answer

Use RSA-4096 for encrypting large datasets.

Answer

Apply XOR-based encryption with a static global key.

Question 20

Refer to the exhibit. An analyst observes this command execution on a workstation. Which immediate action represents the most effective containment strategy?

Accepted Answer

Isolate the workstation from the network. The exhibit shows base64 encoded PowerShell execution, commonly used for malicious script downloads. Immediate containment requires isolating the endpoint from the network to prevent further outbound connections to C2 servers. By severing the network connection, responders prevent the attacker from executing additional instructions, exfiltrating data, or establishing secondary persistence mechanisms while the forensic investigation proceeds offline.

Answer

Reboot the workstation immediately

Answer

Delete the PowerShell process

Answer

Update the antivirus definitions