GSEC Practice Test 3 — 10 Questions

Question 1

A Linux web server was compromised through a vulnerable PHP application. The attacker uploaded a web shell and is now using it to run commands. An incident responder needs to determine how the attacker is maintaining access after reboots. Which artifact should the responder check first to identify a persistent mechanism on this Linux host?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The crontab entries for all users and the /etc/cron.* directories.. On Linux, cron jobs are a primary persistence mechanism because they run on a schedule and survive reboots. An attacker with web shell access often adds a crontab entry or a file in /etc/cron.d that re-downloads a payload or opens a reverse shell. Checking all user crontabs and the system cron directories is therefore the most direct first step to identify how access is maintained, ahead of logs that only show activity rather than configuration.

Answer

The /etc/passwd file for accounts with UID 0.

Answer

The Apache access log for POST requests to the vulnerable PHP script.

Answer

The /var/log/auth.log file for failed SSH login attempts.

Question 2

A responder is preparing to image a compromised Windows server's memory before shutting it down. The server hosts a critical database and management insists on minimal downtime. Which action best preserves the most volatile evidence while respecting the operational constraint?

Accepted Answer

Capture a full physical memory dump using a trusted tool, then proceed with containment and shutdown.. The order of volatility dictates that the most perishable evidence, such as RAM contents, be collected first. A physical memory dump captures running processes, network connections, and in-memory-only malware before containment actions alter or destroy them. Once memory is secured, the responder can contain and shut down the server, satisfying both forensic integrity and the operational requirement to minimize downtime.

Answer

Disconnect the server from the network, then capture memory after confirming no active sessions remain.

Answer

Shut down the server immediately to prevent lateral movement, then image the disk on a write blocker.

Answer

Run a full antivirus scan and collect the resulting log before capturing memory.

Question 3

A retail company is deploying a large language model (LLM) based customer support assistant that has access to internal order databases through a tool-calling interface. The security team wants to reduce the risk of sensitive data being exposed through the model's responses. Which two controls best address this risk? (Choose two.)

Accepted Answer

Enforce least-privilege access on the tool-calling interface so the model can retrieve only the fields needed for the current request.. Reducing sensitive data exposure in an LLM assistant requires controlling both what data the model can access and what it can emit. Least-privilege tool access limits the sensitive fields available to the model, while output filtering catches and redacts sensitive patterns before the user sees them. Together they provide defense in depth; the other options affect randomness, model artifact storage, or training, none of which govern runtime data flow.

Answer

Increase the model's temperature setting to make responses less predictable.

Answer

Store the model weights in a versioned object storage bucket with access logging enabled.

Answer

Fine-tune the model on a dataset of historical customer interactions.

Question 4

A security engineer is deploying a network-based intrusion detection system (NIDS) to monitor traffic entering and leaving a data center. The engineer needs to ensure the sensor can see all packets, including those that are fragmented or have errors, without affecting the production traffic flow. Which deployment method should be used?

Accepted Answer

Connect the NIDS to a switched port analyzer (SPAN) port that mirrors all traffic from the core switch.. A passive NIDS deployment using a SPAN port mirrors copies of production traffic to the sensor, allowing full packet inspection without adding latency or risk to the live traffic path. Inline placement can affect production flow, virtual switch promiscuous mode only sees local host traffic, and NetFlow provides summaries rather than full packets. The SPAN port best satisfies the need to see all packets, including fragmented and error frames.

Answer

Configure the NIDS to receive a copy of traffic via NetFlow exports from the core routers.

Answer

Place the NIDS inline between the core switch and the data center router using a fail-open bypass tap.

Answer

Install the NIDS on a virtual machine and connect it to a virtual switch in promiscuous mode on the same host as the web servers.

Question 5

A security team is configuring an authenticated vulnerability scan of a Linux server farm using SSH. The scanner reports that it cannot log in to several hosts even though the same credentials work manually. Which configuration change is MOST likely to resolve the issue?

Accepted Answer

Allow the scanner's public key in the authorized_keys file for the scan account. Authenticated SSH scans rely on the scanner presenting a key that the target accepts. When manual logins work but the scanner fails, the usual cause is that the scanner's public key has not been installed in the scan account's authorized_keys file. Adding that key restores authentication without weakening the host's security posture, unlike enabling password authentication or disabling SELinux.

Answer

Enable password authentication on the target hosts

Answer

Change the SSH port on the targets to 2222

Answer

Disable SELinux on the target hosts

Question 6

A security analyst needs to ensure that sensitive data in transit between two internal servers remains confidential and authenticated. Which protocol provides the most robust security for this requirement?

Accepted Answer

IPsec. IPsec provides end-to-end security at the network layer, ensuring that all data between the two endpoints is encrypted and authenticated regardless of the underlying application. This is essential for protecting sensitive traffic within a private network from sniffing or spoofing. Implementing IPsec allows for granular control over traffic security policies, making it a standard requirement for high-security environments where network-level protection is prioritized over application-specific encryption.

Answer

Telnet

Answer

HTTP

Answer

SNMPv1

Question 7

To ensure a Linux server is protected against unauthorized physical access or boot-level modifications, which THREE security controls should be implemented?

Accepted Answer

Setting a BIOS/UEFI password. Boot security is often overlooked but is a critical component of overall system hardening. If an attacker has physical access and the boot process is not secured, they can easily bypass operating system security controls by booting into single-user mode or using a live environment to mount and modify the local filesystem.

Answer

Enabling the sticky bit on /tmp

Answer

Disabling the IPv6 network stack

Question 8

During a routine vulnerability assessment, an analyst discovers that a network router is responding to ICMP Timestamp requests. What is the primary security risk associated with enabling this service on perimeter networking equipment?

Accepted Answer

Allowing unauthorized entities to gather precise system uptime and clock synchronization data.. Responding to ICMP Timestamp requests leaks the exact system uptime and local clock settings to unauthenticated external entities. Attackers use this timing information to fingerprint operating systems, map network latency anomalies, and design precise timing attacks against time-dependent cryptographic protocols and authentication tokens.

Answer

Enabling remote attackers to execute arbitrary shell commands via buffer overflows in the ICMP daemon.

Answer

Exposing internal private IP address ranges through embedded DNS zone transfer responses.

Answer

Facilitating high-bandwidth distributed denial-of-service reflection attacks using small spoofed packets.

Question 9

A GSEC consultant is hardening a Kubernetes cluster that runs multi-tenant workloads. A developer reports that a pod in the tenants namespace was able to read the contents of the kubelet's host filesystem at /var/lib/kubelet. The pod spec includes hostPath: {path: /var/lib/kubelet, type: Directory} under volumes and mounts it at /host. The cluster has Pod Security Admission enabled with the restricted profile enforced cluster-wide, but the tenants namespace was labeled pod-security.kubernetes.io/enforce: privileged to unblock a legacy job. Which action most directly closes this exposure?

Accepted Answer

Remove the privileged label from the tenants namespace so the restricted profile is enforced there, and refactor the legacy job to run without a hostPath mount.. Pod Security Admission decides admission based on the namespace's pod-security.kubernetes.io/enforce label, and the privileged value on the tenants namespace overrode the cluster-wide restricted profile. That exemption is precisely what let a pod mount the node's /var/lib/kubelet directory via hostPath. Removing the label restores restricted enforcement, which forbids hostPath volumes, and refactoring the legacy job removes the need for the exemption so the exposure cannot be recreated.

Answer

Enable the NodeRestriction admission plugin and rotate the kubelet client certificates on all worker nodes.

Answer

Add a seccomp profile of RuntimeDefault to the pod and set allowPrivilegeEscalation to false in its securityContext.

Answer

Create an OPA Gatekeeper constraint that denies pods whose namespaces carry the privileged enforcement label.

Question 10

A security administrator is configuring a new wireless intrusion prevention system (WIPS) for a corporate campus. The administrator wants the WIPS to automatically contain an unauthorized access point that is broadcasting the corporate SSID. Which WIPS capability should be enabled to achieve this?

Accepted Answer

Rogue AP containment via over-the-air deauthentication and disassociation frames.. Automatic rogue AP containment in a WIPS works by sending deauthentication and disassociation frames to clients associated with the rogue device, preventing them from using it. This meets the requirement for automatic neutralization. Alerting, spectrum analysis, and location tracking are valuable but do not provide containment. Enabling containment is the direct action that achieves the goal.

Answer

Location tracking of wireless clients.

Answer

Wireless intrusion detection with alerting only.

Answer

Spectrum analysis to identify interference sources.