GSEC Practice Test 4 — 10 Questions

Question 1

A SIEM administrator is troubleshooting why Windows event logs forwarded from a domain controller are not being parsed correctly. The logs are sent using the Windows Event Forwarding (WEF) subscription, but the SIEM shows raw XML instead of normalized fields. The administrator confirms that the WEF subscription is active and events are arriving. Which action should the administrator take to ensure proper parsing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom parser in the SIEM that extracts fields from the XML structure of the WEF events.. WEF forwards events in XML format. If the SIEM's collector is not configured to parse that XML, it stores raw XML and fields are not normalized. The administrator should create a custom parser that extracts relevant fields from the WEF XML schema and maps them to the SIEM's data model. Other options either do not address the parsing issue or are technically infeasible.

Answer

Install a SIEM agent on the domain controller to read the event logs directly and forward them in a normalized format.

Answer

Configure the SIEM to use the Windows Event Log collector with the correct channel names and enable XML parsing.

Answer

Modify the WEF subscription to forward events in JSON format instead of XML.

Question 2

When configuring an Active Directory (AD) environment, which functional level is required to utilize the 'Authentication Policies' feature introduced in Windows Server 2012?

Accepted Answer

Windows Server 2012. The Windows Server 2012 domain functional level introduced significant security improvements, including Authentication Policies and Silos. These allow for the restriction of account usage to specific hosts or services, effectively mitigating the risk of credential theft and lateral movement. Knowing these functional level requirements is critical for architects planning upgrades to ensure that modern security controls are available and correctly implemented across the forest.

Answer

Windows Server 2003

Answer

Windows Server 2008 R2

Answer

Windows Server 2016

Question 3

Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?

Accepted Answer

The Incident Response Plan. An Incident Response Plan (IRP) defines the procedures, roles, and communication paths required during a breach. It is essential for compliance because it dictates the timeline and requirements for notifying regulators and affected parties. Without a pre-established plan, organizations often fail to meet legal reporting deadlines, resulting in significant fines and loss of stakeholder trust, making the IRP a foundational piece of the response process.

Answer

A list of all employee hardware serial numbers

Answer

The corporate employee handbook

Answer

The server room floor plan

Question 4

A security analyst is investigating a suspected credential theft attack on a Windows 10 workstation. The analyst reviews the Security event log and sees Event ID 4648 (A logon was attempted using explicit credentials) occurring repeatedly for a service account. Which of the following best describes the significance of this event in the context of credential theft?

Accepted Answer

It indicates that the service account's credentials were used to run a process with explicit credentials, which could be a sign of pass-the-hash or credential reuse.. Event ID 4648 is generated when a logon is attempted using explicit credentials, such as with RunAs or a scheduled task. In credential theft, attackers may use stolen credentials to start processes, causing this event. Repeated occurrences for a service account can signal malicious activity. Other events like 4625, 4740, or 4672 have different meanings and are not directly indicative of explicit credential use.

Answer

It indicates that the service account was granted special privileges, such as SeDebugPrivilege, which is a common post-exploitation step.

Answer

It indicates that the service account's password was changed, which is a common persistence technique after credential theft.

Answer

It indicates that the service account was locked out due to multiple failed logon attempts, which is a sign of brute-force attack.

Question 5

Which TWO of the following statements accurately describe the characteristics of UDP compared to TCP?

Accepted Answer

UDP is faster due to the lack of a handshake.. UDP is a connectionless, datagram-oriented protocol that prioritizes speed and efficiency over reliability. It does not perform handshakes, flow control, or error correction, making it ideal for real-time applications like VoIP. TCP, conversely, provides a reliable stream by managing connections and acknowledging packet delivery. Understanding these differences is crucial for firewall configuration, as security policies must account for the stateless nature of UDP versus the stateful requirements of TCP.

Answer

UDP provides guaranteed delivery of packets.

Answer

UDP uses flow control to manage data transmission rates.

Answer

UDP is the primary protocol for HTTP web traffic.

Question 6

An organization is deploying Just-In-Time (JIT) administration. Which Windows feature provides the necessary framework for creating temporary, elevated group memberships for domain administrators?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) using Microsoft Identity Manager (MIM) allows for the creation of shadow principals in a separate forest. This approach ensures that administrative rights are only granted for a specific window of time, drastically reducing the impact of a compromised account. This is a vital architectural pattern for securing Active Directory environments against persistent threats that rely on long-lived administrative privileges to maintain access.

Answer

Restricted Groups GPO

Answer

User Rights Assignment policy

Answer

Group Policy Preferences

Question 7

A security analyst suspects an internal host is communicating with a command-and-control server using DNS tunneling. Which network protocol characteristic should the analyst examine to best identify this malicious behavior?

Accepted Answer

Unusually high frequency and elevated entropy levels within TXT or subdomain record queries.. DNS tunneling embeds arbitrary data inside standard DNS queries and responses, primarily utilizing TXT, NULL, or subdomains of A records. Analysing query length and entropy helps security professionals detect abnormal payload sizes that deviate from legitimate domain name resolution patterns, protecting enterprise networks from stealthy data exfiltration and C2 channels.

Answer

TCP connection state tables showing persistent half-open sessions on port 53.

Answer

Frequent receipt of ICMP Destination Unreachable messages indicating blocked UDP traffic.

Answer

Elevated round-trip time latency on standard HTTP GET requests traversing proxy servers.

Question 8

An incident responder notices suspicious memory usage on a protected host. Which endpoint forensic technique is most reliable for detecting file-less malware that resides only in RAM?

Accepted Answer

Performing a memory dump and analyzing it for anomalous process threads.. File-less malware operates by injecting malicious code directly into the memory space of legitimate system processes. Traditional disk-based scanning tools will miss this, as no malicious file exists on the filesystem. Detecting file-less attacks requires inspecting memory for anomalies, such as injected threads or hooked functions, which requires specialized tools capable of analyzing process memory structures in real-time.

Answer

Scanning the hard drive for known malicious file signatures.

Answer

Analyzing the Master File Table (MFT) for deleted entries.

Answer

Checking the Windows Event Logs for failed login attempts.

Question 9

Refer to the exhibit. A network administrator configured port security on a switch interface to protect against unauthorized device connections. Based on the provided configuration snippet, what action will the switch take if a third device with an unknown MAC address connects to this port?

Accepted Answer

The switch will immediately transition the interface into an error-disabled state and shut down port operations.. When port security is configured with a maximum limit of two MAC addresses and a violation mode of shutdown, the switch immediately disables the interface the moment a third unique MAC address attempts to communicate. The port enters an error-disabled state, dropping all traffic until an administrator manually resets the interface or configures an automatic recovery timer.

Answer

The switch will forward the third device's traffic while generating an alert log entry to the central syslog server without dropping packets.

Answer

The switch will drop packets originating from the third device while keeping the physical port in an active operational state.

Answer

The switch will temporarily quarantine the third device in a restricted guest VLAN while awaiting administrator approval.

Question 10

A security engineer is designing a password hashing scheme for a new application. The scheme must be resistant to GPU-accelerated cracking and allow for tuning of CPU and memory costs. Which hashing algorithm should the engineer choose?

Accepted Answer

Argon2. Argon2 is specifically designed to be memory-hard and CPU-hard, with tunable parameters for time, memory, and parallelism. This makes it resistant to GPU-accelerated cracking and allows customization for different environments. bcrypt and PBKDF2 lack memory tuning, and SHA-256 is too fast. Therefore, Argon2 is the correct choice for the password hashing scheme.

Answer

PBKDF2

Answer

bcrypt

Answer

SHA-256 with a random salt