GSEC Practice Test 5 — 25 Questions

Question 1

Your organization is adopting the CIS Critical Security Controls to bolster defense. You are currently focused on establishing a secure baseline configuration for all workstation images. Which specific CIS Control should you prioritize to ensure that unauthorized software and unauthorized configuration changes are mitigated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CIS Control 4: Secure Configuration of Enterprise Assets and Software. CIS Control 4, Secure Configuration of Enterprise Assets and Software, focuses on establishing and maintaining security configurations for hardware and software. By mandating a standardized, hardened baseline for all workstations, the organization reduces the attack surface by eliminating unnecessary services and insecure settings. This is a foundational control that directly supports other security measures by ensuring that endpoints are in a known, secure state before they are deployed into the production network environment.

Answer

CIS Control 1: Inventory and Control of Enterprise Assets

Answer

CIS Control 2: Data Protection

Answer

CIS Control 8: Audit Log Management

Question 2

Which virtualization security concern occurs when an attacker breaks out of the guest operating system to interact directly with the hypervisor?

Accepted Answer

Virtual Machine escape.. A VM escape is a critical vulnerability where an attacker gains access to the host machine from a guest VM. This allows the attacker to compromise other VMs on the same host or the physical hardware itself. Understanding this threat is essential for GSEC professionals, as it represents the highest level of breach in a virtualized infrastructure, requiring rigorous patching and hypervisor hardening.

Answer

Resource exhaustion.

Answer

Snapshot tampering.

Answer

Hypervisor misconfiguration.

Question 3

Which cloud security concept describes the automation of infrastructure deployment using code templates to ensure a consistent, secure, and repeatable environment?

Accepted Answer

Infrastructure as Code.. Infrastructure as Code (IaC) allows for version-controlled, automated, and audited deployment of cloud resources. By treating infrastructure as software, security teams can scan templates for misconfigurations before deployment. This is vital in cloud environments because manual configuration is prone to human error, which is the leading cause of security breaches in modern cloud and virtualization deployments.

Answer

Container Orchestration.

Answer

Serverless Computing.

Answer

Hyper-converged Infrastructure.

Question 4

Refer to the exhibit. Which security risk does the 'HttpOnly' flag specifically mitigate?

Accepted Answer

Cross-Site Scripting (XSS) session theft. The HttpOnly flag is a vital defense against session hijacking via XSS. When this flag is enabled, the browser prevents client-side scripts, such as JavaScript, from accessing the cookie via the document.cookie object. If an attacker successfully executes an XSS attack, they cannot steal the session cookie, thereby preventing them from impersonating the user's session. This is a core defense-in-depth practice for protecting authentication tokens in modern web applications.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) interception

Answer

SQL Injection (SQLi)

Question 5

An IT security team is auditing Windows Update for Business configurations across a multi-site enterprise. Which TWO methods can be utilized by administrators to successfully deploy and enforce these cloud-linked update policies? (Choose TWO)

Accepted Answer

Group Policy Objects (GPOs) applied through Active Directory domains. Windows Update for Business policies can be administered flexibly through traditional enterprise Group Policy or modern cloud-based Mobile Device Management solutions like Microsoft Intune. Providing multiple management pathways enables organizations managing hybrid or fully cloud-native environments to enforce consistent update governance uniformly.

Answer

Manual execution of local PowerShell scripts by end-users with standard privileges

Answer

Direct packet injection via public Wi-Fi access points during routine employee travel

Answer

Editing local security policy templates manually on every individual client workstation

Question 6

An administrator observes that internal users are receiving certificate warnings when accessing a new internal web application. The organization uses an internal Certificate Authority (CA). What is the primary cause of this behavior?

Accepted Answer

The internal Root CA certificate is not installed in the client's local trust store.. Certificate warnings occur when a client cannot establish a chain of trust back to a trusted Root CA. In internal environments, the internal CA certificate must be explicitly imported into the client's trusted root store. Without this root trust, the browser cannot verify the digital signature of the server's certificate, resulting in a trust error. This is a fundamental concept in PKI management for enterprise web security.

Answer

The server certificate has expired, triggering a validity date error in the browser.

Answer

The web server failed to send the intermediate certificate in the handshake process.

Answer

The web application is utilizing an outdated TLS version that browsers no longer support.

Question 7

Refer to the exhibit. What is the effect of the (OI)(CI) flags on the 'Finance_Users' group for the C:\Data directory?

Accepted Answer

Files and subfolders inherit the permissions from the parent.. The (OI) flag stands for Object Inherit, and (CI) stands for Container Inherit. These flags ensure that permissions assigned to the parent folder propagate to all files and subfolders within the directory. This is essential for maintaining consistent access control in environments with deep directory structures. Without these flags, newly created files or subfolders might not inherit the necessary security descriptors, leading to potential access gaps or security policy bypasses.

Answer

Only existing files are modified.

Answer

The permissions are applied to C:\Data only, not children.

Answer

The user cannot delete the folder.

Question 8

During a web application audit, you determine that the server is vulnerable to a 'Slowloris' attack. What is the most likely symptom of this attack on the web server?

Accepted Answer

Exhaustion of available connection slots. Slowloris is a low-bandwidth Denial-of-Service (DoS) attack that keeps connections open by sending partial HTTP requests. By never completing the request headers, the server's connection pool becomes exhausted, leaving no threads available to handle legitimate users. This is a classic example of an application-layer DoS attack, which highlights the importance of configuring proper timeout settings and resource limits on web servers like Apache or Nginx.

Answer

Complete server crash due to memory corruption

Answer

Database downtime caused by excessive query volume

Answer

Unauthorized access to the application root directory

Question 9

A user reports they cannot open a downloaded application because macOS states the developer cannot be verified. Which security feature is preventing the execution of this application?

Accepted Answer

Gatekeeper. Gatekeeper is the security technology that verifies that software is from a trusted developer and has not been tampered with. By requiring code signing and notarization, Gatekeeper helps prevent the execution of malicious software. For a GSEC professional, recognizing Gatekeeper's role is key to troubleshooting deployment issues while maintaining the organization's security policy, as it is the first line of defense against unauthorized applications running on the user's desktop.

Answer

XProtect

Answer

System Integrity Protection

Answer

FileVault 2

Question 10

An enterprise network administrator needs to manage Windows 10 feature updates across a heterogeneous fleet containing both Enterprise and Professional editions. Which deployment methodology natively supports setting a target release version to freeze clients on a specific version like 21H2 while blocking automatic upgrades to later versions?

Accepted Answer

Windows Update for Business configured via Group Policy to specify a target release version. Setting a target release version through Group Policy or Mobile Device Management allows administrators to freeze workstations on a specific Windows 10 feature update, such as 21H2. This control prevents automatic upgrades to newer major OS versions, ensuring mission-critical line-of-business applications remain compatible without requiring immediate manual intervention across every individual endpoint device.

Answer

Windows Server Update Services automatic approval rules targeting all newly released operating system updates

Answer

Consumer Windows Update settings modified through local registry edits on each individual workstation

Answer

Delivery Optimization peer-to-peer distribution bandwidth throttling applied via Local Group Policy

Question 11

A security administrator is troubleshooting an enterprise client that repeatedly fails to complete a major Windows feature upgrade, automatically triggering a rollback. Which built-in command-line utility should the administrator use to examine detailed migration logs, error codes, and rollback triggers?

Accepted Answer

SetupDiag.exe to automatically parse update setup logs and identify failure reasons. SetupDiag is a specialized diagnostic tool designed to analyze Windows setup logs and pinpoint the exact root cause of a failed feature update or rollback. Reviewing these logs allows security and systems engineers to rapidly identify blocking drivers, incompatible applications, or registry corruption preventing successful Windows as a Service upgrades.

Answer

SFC.exe /scannow to inspect operating system file integrity

Answer

DISM.exe /Online /Cleanup-Image /RestoreHealth to repair component stores

Answer

GPResult.exe /h report.html to generate a comprehensive group policy diagnostic report

Question 12

Refer to the exhibit. What is the current configuration state for auditing 'Account Logon' events based on the provided output?

Accepted Answer

Both success and failure are being audited. The output indicates that the 'Account Logon' category is configured to audit both success and failure for credential validation. Auditing this is essential because it captures domain-wide authentication attempts occurring on the domain controller. This visibility is vital for identifying brute-force attacks or anomalous login behavior, providing a foundation for effective incident response and forensic analysis within the Windows infrastructure.

Answer

Only failure events are being audited

Answer

Auditing is completely disabled for this category

Answer

Only success events are being audited

Question 13

An enterprise development team is designing a Kubernetes cluster deployment where application containers frequently interact with cloud provider APIs. To minimize security blast radius, which architectural practice provides the most effective credential isolation per pod?

Accepted Answer

Implement service account token volume projection with short-lived auditable tokens scoped to individual application requirements.. Service account token volume projection utilizes short-lived tokens cryptographically signed by the cluster, mounting them securely into specific pods with restricted audiences. This approach replaces static long-lived credentials stored in environment variables or generic secrets, significantly reducing lateral movement risks if an application is compromised.

Answer

Store cloud provider credentials in base64-encoded Kubernetes Secret objects and mount them as environment variables.

Answer

Configure cluster-wide IAM roles on the underlying worker nodes and allow all hosted pods to inherit administrative permissions.

Answer

Embed the static cloud API keys directly into the container base image layers to ensure consistency across deployments.

Question 14

Which TWO of the following are primary functions of a Public Key Infrastructure (PKI)?

Accepted Answer

Issuance of digital certificates to verify identity.. PKI is vital for managing the lifecycle of digital certificates, ensuring trust in identity. By providing mechanisms for issuance and revocation, PKI allows entities to communicate securely without pre-existing trust. Understanding these functions is essential for GSEC professionals to manage authentication and secure communication channels effectively within an enterprise architecture, preventing the use of expired or fraudulent credentials that could be exploited by malicious actors during network sessions.

Answer

Centralized distribution of symmetric keys.

Answer

Hardware-level encryption for disk storage.

Answer

Real-time traffic flow monitoring and alerting.

Question 15

An administrator needs to restrict sensitive file access on a Windows Server 2022 environment while ensuring that users only access resources based on their job titles. Which Windows technology should be implemented to leverage Dynamic Access Control (DAC) for this requirement?

Accepted Answer

Configure Central Access Policies. Dynamic Access Control allows administrators to apply access policies based on user claims and resource properties rather than traditional security groups alone. By integrating Active Directory claims and resource attributes, you can automate permissions, which significantly reduces the administrative overhead of managing thousands of individual NTFS permissions. This is critical for maintaining the principle of least privilege in scaling enterprise environments where group-based memberships become too complex to manage effectively.

Answer

Implement Kerberos Constrained Delegation

Answer

Apply AppLocker Software Restriction Policies

Answer

Utilize Encrypting File System (EFS)

Question 16

During an internal network security audit, an engineer discovers that workstations on the human resources VLAN can directly communicate with sensitive database servers on the finance VLAN without passing through a filtering device. Which foundational architectural control is missing from this environment?

Accepted Answer

Enforcing inter-VLAN access control lists or deploying an internal firewall to inspect and restrict traffic between functional zones.. Micro-segmentation and internal routing firewalls are essential for enforcing least privilege communication between distinct functional business units. When VLANs reside on a core router or multi-layer switch without inter-VLAN access control lists, traffic flows freely between security zones. Implementing internal firewalls between these segments ensures that human resources workstations only access authorized HR applications.

Answer

Deploying a high-availability server load balancer in front of the human resources workstation subnet.

Answer

Upgrading all edge routers to support Border Gateway Protocol with strict cryptographic route validation.

Answer

Replacing all traditional dynamic host configuration protocol scopes with static IP address assignments.

Question 17

A security engineer is segmenting a data center so that contractors who maintain HVAC systems cannot initiate connections into the server VLAN, but the internal monitoring platform must still reach the contractor subnet to poll building-management sensors. The chosen design uses a stateful firewall between the two zones with the contractor zone as the untrusted side. Which configuration best enforces the required traffic direction while preserving monitoring?

Accepted Answer

Configure the firewall so the monitoring platform initiates sessions into the contractor zone, allowing only established, return traffic back to the monitoring platform.. The requirement is directional control between zones, so a stateful firewall must see the trusted monitoring platform initiate the session and then allow only the return traffic for that established flow. Contractors are thereby unable to originate connections into the server VLAN, while polling of building-management sensors continues. Stateless ACLs and private addressing do not provide this session-aware, one-way enforcement.

Answer

Place both zones behind a single perimeter firewall and permit all inter-zone traffic, relying on the contractor VLAN's private IP addressing to prevent reachability.

Answer

Apply an ACL on the contractor zone's router interface that permits only the monitoring platform's IP to the sensor subnet and denies all other traffic in both directions.

Answer

Configure a stateful firewall rule permitting the contractor subnet to the sensor subnet on the management ports, and add an implicit deny at the end of the rule base.

Question 18

A security engineer is designing an internal Public Key Infrastructure (PKI) and needs to issue a subordinate certificate authority (sub-CA) certificate. To prevent this sub-CA from accidentally or maliciously issuing certificates for unauthorized domains, what specific X.509 extension must be correctly configured?

Accepted Answer

Name Constraints extension configured with explicit permitted and excluded subtree subdirectories for domain namespaces.. Name Constraints restrict the namespace within which all subject names in certificates issued by the CA must reside. This crucial X.509 extension prevents a compromised subordinate CA from generating trusted certificates for domains outside its permitted organizational scope, thereby containing blast radius in enterprise PKI hierarchies.

Answer

Key Usage extension populated solely with Digital Signature, Non-Repudiation, and Key Encipherment flags.

Answer

Authority Information Access extension pointing directly to the organization's primary online OCSP responder.

Answer

Extended Key Usage extension restricted strictly to TLS Web Server Authentication and Code Signing.

Question 19

A retail company is reviewing its defense in depth strategy after a breach where an attacker used stolen credentials to access a database server. The investigation showed that the server had no host-based logging, and database activity was not monitored. Which TWO controls should be added to improve detection of similar future attacks? (Choose two.)

Accepted Answer

Deploying host-based intrusion detection system (HIDS) agents on database servers. The breach exploited stolen credentials to access a database server, and the gaps were lack of host-based logging and database activity monitoring. HIDS agents provide host-level visibility into attacker actions, while DAM logs and alerts on suspicious database queries. Together they create detective controls that would likely have identified the unauthorized access. The other options are preventive or confidentiality controls that do not address the detection gap.

Answer

Enforcing a password complexity policy for all database accounts

Answer

Implementing full-disk encryption on the database server

Answer

Configuring a next-generation firewall to block outbound traffic from the database server

Question 20

A hospital's IT team is designing layered defenses for its electronic health record (EHR) system. They already have perimeter firewalls, network intrusion prevention, and endpoint antivirus. The CISO wants to add a control that detects unauthorized modification of EHR database records and alerts the security team in near real time. Which control best fills this gap while preserving defense in depth?

Accepted Answer

File integrity monitoring (FIM) with cryptographic hashing on the EHR database files. The scenario requires a detective control that specifically identifies unauthorized changes to EHR database records. File integrity monitoring with cryptographic hashing provides exactly that by comparing current file hashes to a trusted baseline and alerting on mismatch. The other options either duplicate existing preventive controls or provide logging without integrity detection, leaving the data-layer gap unaddressed.

Answer

Implementing full-disk encryption on the EHR database servers

Answer

Configuring syslog forwarding from the EHR servers to a central SIEM

Answer

Deploying an additional host-based firewall on the EHR application servers