GSEC Practice Test 5 — 10 Questions

Question 1

Which of the following is the most effective way to prevent secrets (such as API keys) from being leaked via container images?

Accepted Answer

Use orchestrator-native secret management to inject secrets at runtime.. Secrets should never be baked into container images because they remain in the image layers even if deleted in later steps. Once an image is pushed to a registry, those secrets are accessible to anyone with pull access. Using orchestrator-native secret management (like Kubernetes Secrets or Vault) ensures that sensitive data is injected at runtime, keeping it out of the persistent image layers and the source control history.

Answer

Encrypt the Dockerfile using a secret key before building.

Answer

Delete the secrets in a subsequent RUN layer during the build.

Answer

Set the file permissions on the secret to 600 after copying it.

Question 2

A security analyst is examining a web application that uses JSON Web Tokens (JWT) for authentication. The analyst captures a token and notices that the header contains "alg": "none". The analyst is concerned about the security of the application. Which of the following best describes the risk associated with this token?

Accepted Answer

The token is unsigned, allowing an attacker to modify the payload and forge valid tokens.. A JWT with "alg": "none" is unsigned, meaning it has no integrity protection. An attacker can tamper with the payload and, if the server accepts such tokens, forge arbitrary claims. This can lead to authentication bypass or privilege escalation. The correct answer identifies that the token is unsigned and can be modified. The other options mischaracterize the token as encrypted, weakly signed, or solely vulnerable to replay, missing the core issue of missing signature verification.

Answer

The token uses a weak signing algorithm that can be brute-forced to recover the secret key.

Answer

The token is vulnerable to replay attacks because it lacks an expiration claim.

Answer

The token is encrypted, so the contents cannot be read by an attacker.

Question 3

A financial services firm is aligning its security program with the CIS Critical Security Controls. The CISO wants to ensure that the organization can measure the effectiveness of its security posture over time and prioritize improvements. Which of the following should the security team implement to achieve this?

Accepted Answer

Adopt the CIS Risk Assessment Method (CIS RAM) to identify, analyze, and prioritize risks based on the CIS Controls.. CIS RAM is specifically designed to help organizations implement the CIS Controls by providing a repeatable, risk-based assessment method. It enables the security team to measure the effectiveness of controls, identify gaps, and prioritize remediation efforts. Other options, while valuable, do not offer the same direct alignment with CIS Controls for measuring and improving security posture over time.

Answer

Conduct a penetration test to identify vulnerabilities in the organization's external-facing infrastructure.

Answer

Deploy a SIEM solution to collect and correlate security events from all network devices.

Answer

Implement the NIST Cybersecurity Framework to map current activities to the five core functions.

Question 4

A security engineer is designing a secure enterprise environment and needs to deploy network intrusion detection sensors to monitor east-west traffic moving between virtual machines inside an internal virtualization cluster. Which deployment method ensures the sensors successfully inspect internal segment traffic without introducing a single point of failure for packet forwarding?

Accepted Answer

Configuring hypervisor-level distributed virtual switches to mirror east-west traffic to dedicated virtual security monitoring appliances.. Using virtual tap interfaces or distributed software switches configured for port mirroring allows security sensors to receive copies of internal traffic traversing the hypervisor backplane. This approach ensures comprehensive visibility into east-west lateral movement without altering inline packet forwarding paths, maintaining network availability while delivering the necessary telemetry for threat detection engines.

Answer

Placing a dedicated physical inline bump-in-the-wire network intrusion prevention system between every internal virtual switch uplink.

Answer

Routing all inter-VLAN traffic through a single legacy perimeter firewall using hardware router-on-a-stick configurations.

Answer

Disabling all stateful packet inspection on internal firewalls to allow maximum throughput for east-west virtualization traffic.

Question 5

A university is implementing CIS Control 6: Access Control Management. They want to ensure that user accounts are properly managed. Which of the following actions best aligns with the requirement to manage the lifecycle of user accounts?

Accepted Answer

Conducting quarterly reviews of all user accounts to identify and disable inactive accounts.. Quarterly reviews of user accounts directly support the lifecycle management requirement of CIS Control 6. By identifying and disabling inactive accounts, the university reduces the risk of unauthorized access through stale credentials. Other actions like password policies, MFA, and PAM are valuable but do not fulfill the specific need to manage account lifecycles across all users.

Answer

Implementing multi-factor authentication for all administrative access to servers.

Answer

Deploying a privileged access management (PAM) solution to vault administrative credentials.

Answer

Enforcing a password complexity policy that requires 12 characters with mixed case and symbols.

Question 6

An administrator is configuring NTFS permissions on a folder named C:\Audit. The folder currently has inheritance enabled from C:\, which grants Users Read & Execute. The administrator wants to prevent members of the group Temp_Contractors from accessing the folder, but they must still be able to access other folders on the C: drive. The administrator adds an explicit Deny Full Control permission for Temp_Contractors on C:\Audit. What is the effect of this change?

Accepted Answer

Members of Temp_Contractors will be denied access to C:\Audit, but will retain their inherited permissions on other folders.. Explicit Deny permissions override inherited Allow permissions. Placing a Deny Full Control for Temp_Contractors on C:\Audit blocks their access to that folder and its subfolders (if inheritance is enabled), but does not affect other folders on the C: drive. Therefore, the correct outcome is that Temp_Contractors are denied access to C:\Audit while retaining access to other folders.

Answer

Members of Temp_Contractors will be denied access to the entire C: drive because Deny permissions propagate upward.

Answer

The Deny permission will be ignored because inherited Allow permissions take precedence over explicit Deny permissions.

Answer

Members of Temp_Contractors will still have access to C:\Audit because they are also members of the Users group, which has inherited Allow permissions.

Question 7

A security administrator is reviewing the security configuration of a Windows 10 workstation. The administrator notices that the workstation has the 'Secondary Logon' service disabled. Which of the following is the MOST likely impact of this configuration?

Accepted Answer

Users will be unable to run applications as a different user using the 'Run as different user' option.. The Secondary Logon service is responsible for allowing users to start processes under alternate credentials. Disabling it prevents the use of 'Run as different user' and runas.exe, but does not affect interactive logon, domain join, or Remote Desktop. Therefore, the most likely impact is the inability to run applications as a different user.

Answer

Users will be unable to log on interactively to the workstation.

Answer

Remote Desktop connections to the workstation will be blocked.

Answer

The workstation will be unable to join a domain.

Question 8

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

Accepted Answer

Get-LocalGroupMember -Group Administrators. Effective auditing requires querying local identity stores and task schedules. 'Get-LocalGroupMember' provides a snapshot of accounts with elevated or specific access, while 'Get-ScheduledTask' identifies persistent malicious mechanisms. Understanding these commands is critical for GSEC professionals to perform rapid host-based forensics, as these two areas are frequent targets for persistence and lateral movement by attackers.

Answer

Get-Process -IncludeUserName

Answer

Get-Service | Where-Object {$_.Status -eq 'Running'}

Answer

Get-WinEvent -LogName Security

Question 9

A software company is hardening its Linux build pipeline. The team wants to apply defense in depth controls that reduce the impact of a compromised build server. Which THREE actions best support this goal? (Choose three.)

Accepted Answer

Require all build servers to authenticate users with individual SSH keys and disable password authentication.. Reducing the impact of a compromised build server requires layered constraints: container isolation with dropped capabilities and read-only filesystems limits what code can do, HSM-backed signing keys with dual authorization protect the supply chain, and per-user SSH keys harden initial access. Disabling SELinux and granting unrestricted sudo both expand attacker privileges, so they weaken rather than strengthen the layered defense.

Answer

Grant the build service account passwordless sudo access to all commands to simplify automation.

Answer

Disable SELinux on the build server to avoid build failures caused by mandatory access control denials.

Question 10

Microsoft releases major Windows feature updates under a predictable cadence as part of the Windows as a Service model. How often are Windows 10 and Windows 11 Enterprise feature updates officially released under the modern servicing model?

Accepted Answer

Once every year, specifically during the second half of the calendar year. Feature updates for modern Windows operating systems are released annually in the second half of the calendar year for Enterprise and Education editions. Understanding this release frequency helps security professionals plan robust testing cycles and maintain predictable deployment schedules across corporate networks.

Answer

Every month alongside regular cumulative security patches

Answer

Every six months with equal priority given to spring and autumn releases

Answer

Once every three years to coincide with major hardware refresh cycles