GSEC Practice Test 26 — 15 Questions

Question 1

A security administrator needs to ensure that all Windows 10 workstations in a domain automatically forward their security event logs to a central collector to prevent tampering and enable correlation. The organization uses Group Policy. Which of the following should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable "Windows Event Forwarding" via the Group Policy setting "Configure target Subscription Manager" under Computer Configuration > Administrative Templates > Windows Components > Event Forwarding.. Windows Event Forwarding (WEF) is the native mechanism for collecting events from multiple computers. The Group Policy setting "Configure target Subscription Manager" tells source computers where to send events. The collector then uses subscriptions to filter and store events. This approach is scalable, secure, and supports real-time forwarding. It also allows the collector to use a dedicated service account and can be configured to use HTTPS for encryption, preventing tampering and enabling centralized analysis.

Answer

Enable the "Audit: Force audit policy subcategory settings" policy and set the Security log to archive when full.

Answer

Deploy a custom PowerShell script via Group Policy that runs at startup to copy the Security.evtx file to a network share.

Answer

Configure the "Maximum Log Size" for the Security log to a large value and enable "Overwrite events as needed".

Question 2

A security engineer is hardening a Windows Server 2019 domain controller. The organization wants to ensure that all service accounts used by critical services are managed automatically, with password rotation handled by Active Directory, and that the password is not stored locally on the server. Which of the following should the engineer implement?

Accepted Answer

Implement Group Managed Service Accounts (gMSAs) for the services.. Group Managed Service Accounts (gMSAs) are designed for automatic password management across multiple servers. Active Directory manages the password, rotating it every 30 days, and the password is not stored locally. This satisfies the need for domain-wide service accounts with no local password storage, unlike sMSAs, virtual accounts, or standard user accounts.

Answer

Use virtual accounts for each service.

Answer

Create standard domain user accounts and configure them with a long, complex password that never expires.

Answer

Configure each service to use a standalone Managed Service Account (sMSA).

Question 3

A junior administrator is preparing a new Ubuntu server for production. The security policy states that the root account must not be usable for direct interactive logon, and that administrative tasks must be performed through a named account with elevated privileges. Which configuration change best enforces this policy?

Accepted Answer

Lock the root account password with 'passwd -l root' and grant administrative rights to named accounts via sudo.. The policy demands that root cannot be used for interactive logon and that administrative work be done through named accounts with elevated privileges. Locking the root password prevents password-based interactive authentication while sudo allows auditable, per-user elevation. Disabling only SSH root logon leaves console access open, and deleting root from /etc/shadow risks breaking the system. A long password still permits direct root logon and is not a technical enforcement of the policy.

Answer

Change root's shell to /sbin/nologin in /etc/passwd and delete the root entry from /etc/shadow.

Answer

Set a very long, complex password for root and store it in a sealed envelope in a safe.

Answer

Add 'PermitRootLogin no' to /etc/ssh/sshd_config and restart the SSH service, leaving local console root logon enabled.

Question 4

You are auditing a Windows server and need to identify which user accounts have recently utilized elevated privileges. Which specific Event ID should you prioritize in the Security log?

Accepted Answer

Event ID 4672. Event ID 4672 is generated immediately upon a successful logon when a user is assigned special privileges, such as SeDebugPrivilege or SeBackupPrivilege. Auditing this ID allows administrators to track the lifecycle of administrative access, effectively mapping privilege escalation to specific user sessions. Monitoring this is critical for detecting potential account compromise or unauthorized administrative activity within the Windows environment.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 1102

Question 5

An architect is designing a defensible architecture that must detect reconnaissance scanning against a sensitive research subnet without alerting on normal vulnerability-scanner traffic that the security team runs weekly from an authorized scanner host. The design will use an intrusion detection sensor on a SPAN port. Which combination of capabilities best meets the requirement?

Accepted Answer

Deploy a signature-based IDS tuned to scan signatures and configure a pass rule for the authorized scanner's IP address above the scan-detection rules.. Suppression must be tied to the identity of the authorized scanner, and a pass rule ordered ahead of the scan-detection signatures achieves that on a signature-based sensor. Other sources probing the research subnet still generate alerts, so reconnaissance remains detectable. Anomaly baselining, disabled signatures, and volume thresholds all fail because they suppress or remove detection without distinguishing the trusted scanner from an attacker.

Answer

Deploy an anomaly-based IDS with a baseline that includes the weekly scanner, and alert only when traffic deviates from that baseline.

Answer

Deploy a signature-based IDS and disable all scan-detection signatures, relying on firewall logs to reveal reconnaissance activity.

Answer

Deploy a signature-based IDS and configure a suppression threshold that ignores any source generating more than one hundred alerts per hour.

Question 6

A system administrator notices that a user account has 'Read' permissions to a folder but is unable to access the files within it. Which Windows security mechanism is most likely restricting the user's access despite the NTFS permission settings?

Accepted Answer

Share Permissions. Effective access in Windows is the intersection of NTFS permissions and Share permissions. If an account is denied access at the Share level, it will override any Read permissions granted via NTFS. Understanding this dual-layer architecture is critical for troubleshooting access issues, as security professionals must verify both file system attributes and network-level sharing configurations to ensure that policies are applied correctly and consistently across the environment.

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Answer

Group Policy Object (GPO) Inheritance

Question 7

A media company uses a public cloud IaaS environment to render video. An attacker compromises an application running on an EC2 instance and attempts to retrieve temporary credentials from the instance metadata service to access an S3 bucket containing unreleased content. The security team wants to prevent this credential theft without breaking legitimate application access. Which measure most effectively mitigates this risk?

Accepted Answer

Enforce IMDSv2 with a hop limit of 1 and require token-based sessions for metadata requests.. Instance metadata service credentials are a frequent target because they grant the instance's role permissions. IMDSv2 adds a session-oriented token requirement that defeats simple SSRF and credential-harvesting scripts, while a hop limit of 1 blocks access from containers or proxies on the instance. These controls preserve legitimate access through the token flow while removing the easiest paths to steal temporary credentials.

Answer

Disable the S3 bucket's default encryption so that stolen credentials cannot decrypt the content.

Answer

Attach a broader IAM role to the instance so that stolen credentials have more permissions but are easier to rotate.

Answer

Store long-term IAM user access keys in the application configuration file on the instance.

Question 8

A Windows workstation in the finance department suddenly starts launching PowerShell with an encoded command line shortly after a user opens a malicious Excel attachment. The endpoint has Microsoft Defender Antivirus enabled, but no PowerShell logging or script block logging is configured. Which action best mitigates this class of malicious code execution while preserving the ability to investigate the encoded payload?

Accepted Answer

Enable PowerShell script block logging and module logging through Group Policy, then collect the events in Windows Event Forwarding for analysis.. Encoded PowerShell commands hide the real script from casual command-line inspection, so the effective mitigation is to force PowerShell to log the de-obfuscated script blocks and module activity. Centralizing those events through Windows Event Forwarding lets analysts review the decoded payload and build detections, addressing both mitigation and evidence preservation without breaking legitimate administration.

Answer

Configure AppLocker default rules to allow only administrators to run PowerShell scripts in the environment.

Answer

Disable the Windows Script Host on all workstations by setting the Enabled registry value under WSH settings to 0.

Answer

Add the finance department's subnet to the Microsoft Defender Antivirus network inspection exclusion list.

Question 9

Which Windows component is responsible for the centralized management of security configurations, including password policies and user rights, across a domain?

Accepted Answer

Group Policy Objects. Group Policy Objects (GPOs) allow administrators to define specific configurations for users and computers across the entire domain. By centralizing these settings, security teams can ensure consistent enforcement of hardening standards and compliance policies. Proper GPO management is essential for minimizing the attack surface and maintaining a uniform security baseline in any enterprise Windows architecture.

Answer

Windows Registry

Answer

Task Scheduler

Answer

Microsoft Management Console

Question 10

A GSEC analyst is reviewing the deployment pipeline for a containerized Node.js service. The Dockerfile contains a layer that runs `curl -fsSL https://example.com/install.sh | sh` during the build, before the image is pushed to an internal registry. The registry enforces vulnerability scanning, and the image is deployed to a Kubernetes cluster with a restrictive NetworkPolicy. Which of the following is the primary supply chain risk introduced by this Dockerfile instruction?

Accepted Answer

The remote script is fetched without integrity verification, so the image may include tampered or malicious content that scanning cannot reliably detect.. Fetching and executing a remote script during a Docker build introduces unverified third-party code into the image. Because there is no checksum or signature validation, a compromised endpoint can inject malicious content that becomes part of a trusted image. Registry scanning may not catch bespoke or obfuscated payloads, so the integrity of the supply chain is the primary concern.

Answer

The instruction allows the build host's environment variables, including registry credentials, to be exfiltrated by the remote script.

Answer

The curl command creates a writable layer that persists at runtime and can be modified by an attacker after deployment.

Answer

The instruction bypasses Kubernetes NetworkPolicy because build-time traffic does not originate from a pod in the cluster.

Question 11

A security administrator is hardening the boot process of a production Ubuntu 22.04 server that uses GRUB 2. The policy requires that any interactive modification to the kernel command line at the GRUB menu must be blocked, and that the bootloader configuration file must be unreadable by unprivileged users. Which action should the administrator take to meet these requirements?

Accepted Answer

Run grub-mkpasswd-pbkdf2, add a superuser entry with the resulting hash to /etc/grub.d/40_custom, and set chmod 600 on /boot/grub/grub.cfg.. Blocking interactive GRUB edits requires a bootloader password so the menu cannot be modified without authentication, and protecting grub.cfg with restrictive permissions prevents unprivileged users from reading boot parameters. The other choices either only hide the menu, rely on firmware verification that does not restrict menu editing, or introduce a recovery parameter that reduces security. Together, the password and file permission changes satisfy both parts of the policy.

Answer

Enable the UEFI Secure Boot option in firmware and reinstall the operating system with a signed kernel.

Answer

Set GRUB_TIMEOUT=0 in /etc/default/grub and run update-grub to hide the menu.

Answer

Add the kernel parameter init=/bin/bash to /etc/default/grub and regenerate the bootloader configuration.

Question 12

A security engineer is deploying a next-generation firewall (NGFW) at the perimeter of a company's network. The NGFW must enforce security policies based on application identity and user identity, not just IP addresses and ports. The engineer needs to ensure that the firewall can identify applications even when they use non-standard ports or attempt to evade detection by tunneling over HTTP. Which NGFW feature should the engineer configure to meet these requirements?

Accepted Answer

Application-aware filtering with deep packet inspection (DPI). Application-aware filtering with deep packet inspection is designed to identify applications by analyzing payload content and behavior, not just ports. This enables enforcement of policies based on application identity and detects tunneling or evasion. The other options address different aspects like state tracking, user mapping, or decryption, but none provide the required application identification.

Answer

User identity awareness via LDAP integration

Answer

SSL/TLS decryption with certificate pinning

Answer

Stateful packet inspection (SPI) with port-based rules

Question 13

A security administrator is hardening authentication on a set of Linux servers that will be accessed by third-party contractors. Management requires that contractors authenticate with a one-time code delivered by a hardware token, while local administrators continue to use their existing passwords, and that both methods can be used on the same SSH service without changing the client software. Which approach best meets these requirements?

Accepted Answer

Deploy RADIUS backed by a token server, point sshd at PAM's pam_radius_auth.so, and let the RADIUS policy assign token authentication to contractor accounts and password authentication to administrator accounts.. The requirement is per-account, per-method authentication on a shared SSH service with no client changes. A RADIUS-backed token server reached through PAM lets the authentication policy decide which accounts need a hardware token and which may use a password, while sshd continues to use its normal PAM stack. This preserves existing clients and separates the two populations cleanly, matching every stated constraint.

Answer

Configure PAM to stack pam_unix.so and pam_google_authenticator.so with the requisite control flag in /etc/pam.d/sshd so both factors are required for every account.

Answer

Set PasswordAuthentication to no and ChallengeResponseAuthentication to yes in sshd_config, then distribute hardware tokens to all accounts so every user supplies a one-time code.

Answer

Issue each contractor an SSH certificate signed by an internal CA and configure sshd with TrustedUserCAKeys, leaving administrator accounts on password authentication.

Question 14

A university's research department stores controlled unclassified research data on a Windows file server. The IT team wants to implement a defense in depth control that ensures only authorized users can access the data even if they have physical access to the server room. Which of the following controls best meets this requirement?

Accepted Answer

Full disk encryption using BitLocker. The scenario requires a control that protects data even when an attacker has physical access to the server. Full disk encryption such as BitLocker encrypts the entire volume, rendering the data unreadable without the decryption key, regardless of user permissions or network controls. Thus, it provides a necessary layer in a defense in depth strategy for data at rest.

Answer

Security auditing and log monitoring

Answer

Host-based firewall rules

Answer

NTFS permissions with least privilege

Question 15

A financial firm is architecting a new cardholder data environment (CDE) that must comply with PCI DSS segmentation requirements. The security team proposes using a single internal VLAN with host-based firewalls on each server to isolate CDE systems from corporate desktops. The auditor rejects this design. Which approach BEST meets the requirement for defensible network segmentation?

Accepted Answer

Place CDE systems in a dedicated VLAN and enforce inter-VLAN access control with a stateful firewall that permits only required flows from corporate networks.. A dedicated VLAN combined with a stateful firewall creates a clear enforcement boundary where only explicitly permitted flows can enter the CDE. This design provides the isolation, logging, and policy control that PCI DSS auditors expect. Host-based controls alone cannot substitute for network segmentation because they do not prevent lateral movement across the flat network.

Answer

Keep all systems in one VLAN but require 802.1X authentication for every desktop before it can send traffic to CDE servers.

Answer

Implement private VLANs (PVLANs) on the access switches so that CDE servers are in an isolated secondary VLAN and corporate desktops are in a community VLAN.

Answer

Deploy host-based firewalls on each CDE server and configure them to allow only connections from the corporate desktop subnet.