GSEC Practice Questions 1 — 50 Questions

Question 1

When designing a secure container orchestration strategy, which approach best minimizes the impact of a compromised container on the host kernel?

Accepted Answer

Use a specialized container runtime like gVisor to intercept system calls.. Kernel vulnerabilities are a primary vector for container escapes. By using technologies like gVisor or Kata Containers, the container environment uses a hardened kernel or a separate micro-VM, providing an additional layer of isolation. Standard containers share the host kernel directly; if the kernel is exploited via a system call, the attacker can break out of the container boundary entirely, leading to full system compromise of the underlying host node.

Answer

Disable all kernel modules on the host operating system.

Answer

Increase the memory limit for every container in the cluster.

Answer

Run all containers with the --privileged flag to ensure compatibility.

Question 2

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Accepted Answer

It maps Security Identifiers (SIDs) to user profile directories.. The ProfileList key maps SIDs to user profile paths. This is critical because an attacker may create a temporary or hidden account. By identifying the exact path to the user profile, the investigator knows where to look for user-specific artifacts like NTUSER.DAT, browser history, and temporary files. This mapping is the starting point for scoping user-level malicious activities and ensuring that no hidden accounts are overlooked during the investigation.

Answer

It defines the system's default language settings.

Answer

It logs every application the user has executed.

Answer

It lists all installed software on the system.

Question 3

A company stores backup tapes offsite. An auditor notes that the tapes contain sensitive customer data and are transported by a third-party courier. The security manager wants to ensure that a lost tape cannot expose customer information. Which control best addresses this risk?

Accepted Answer

Encrypt the backup tapes using AES-256 with keys managed separately from the tapes.. The risk is that a lost or stolen tape exposes customer data, so the control must make the data unreadable without authorization. Encrypting tapes with AES-256 and storing keys separately achieves this directly. NDAs, GPS tracking, and shorter retention periods address accountability, recovery, or exposure windows but leave the tape contents readable if the media falls into the wrong hands.

Answer

Require the courier to sign a non-disclosure agreement and provide chain-of-custody documentation.

Answer

Install GPS trackers on the transport vehicle and monitor the route in real time.

Answer

Reduce the backup retention period from one year to thirty days to limit exposure.

Question 4

A financial institution is implementing a new access control system for its trading floor. The security team must enforce a model that supports dynamic, fine-grained access decisions based on user attributes, resource attributes, and environmental conditions such as time of day. The system must also allow for centralized policy management and auditing. Which TWO of the following access control models best fit these requirements? (Choose two.)

Accepted Answer

Policy-Based Access Control (PBAC). Attribute-Based Access Control and Policy-Based Access Control both support dynamic, fine-grained access decisions using attributes and environmental conditions. They allow centralized policy management and auditing, which are critical for the financial institution. RBAC, MAC, and DAC lack the necessary flexibility and context-awareness. Therefore, ABAC and PBAC are the correct choices.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 5

A security administrator is reviewing web server logs and notices a high volume of requests with different User-Agent strings, all targeting the same URL with varying query parameters. The requests appear to be attempting to inject SQL commands. Which of the following is the most effective mitigation to prevent SQL injection in this scenario?

Accepted Answer

Use parameterized queries (prepared statements) for all database access.. SQL injection occurs when user input is improperly concatenated into SQL queries. Parameterized queries, also known as prepared statements, ensure that input is bound as parameters and never interpreted as SQL code. This eliminates the vulnerability entirely. While WAFs and input validation can help, they are not as reliable or comprehensive. Therefore, using parameterized queries is the most effective mitigation.

Answer

Deploy a Web Application Firewall (WAF) with SQL injection signatures.

Answer

Implement strict input validation to allow only alphanumeric characters.

Answer

Encode all user input using HTML entity encoding before storing in the database.

Question 6

A security engineer is configuring a new AWS S3 bucket to store sensitive PII. Which combination of settings best adheres to the principle of least privilege for the bucket policy?

Accepted Answer

Restrict access to specific IAM roles and require Secure Transport.. Proper S3 configuration requires a defense-in-depth approach that prevents public access while explicitly restricting actions to necessary services. By blocking public access, enforcing TLS for transit, and using explicit IAM roles, the organization minimizes the attack surface. This is vital because S3 buckets are frequent targets for misconfiguration that leads to data exposure, making granular policy control an essential defensive requirement for protecting cloud-based sensitive information.

Answer

Enable public access and rely on bucket ACLs for granular object permission.

Answer

Assign full administrative rights to the bucket root user for ease of management.

Answer

Use a wildcard principal in the bucket policy to allow internal cross-account access.

Question 7

A financial services firm has deployed a next-generation firewall at its internet perimeter, host-based firewalls on every workstation, and VLAN segmentation between departments. During a purple-team exercise, analysts discover that a contractor's laptop, once connected to the internal network, can reach the HR payroll server directly over SMB. The security team wants to enforce the principle of least privilege on this internal traffic. Which control should they implement to best achieve this?

Accepted Answer

Implement internal microsegmentation with host-based firewall rules that allow only authorized HR subnets to reach the payroll server on TCP 445.. The contractor's laptop is an internal host, so perimeter and network-based detective controls do not stop it from reaching the payroll server. Microsegmentation with host-based firewall rules enforces least privilege by permitting only the HR subnet to use SMB against that server. This limits lateral movement and adds a granular layer of defense that complements existing perimeter and segmentation controls.

Answer

Deploy an intrusion prevention system (IPS) on the internal network to block SMB exploits.

Answer

Enable port security on the access switch to limit the number of MAC addresses per port.

Answer

Configure the perimeter firewall to block all inbound SMB traffic from the internet.

Question 8

Refer to the exhibit. An administrator runs the provided command on a macOS device to verify the security configuration. Given the output, what is the most appropriate interpretation regarding the security posture of this endpoint?

Accepted Answer

The endpoint's kernel integrity protections are actively enforced.. The output confirms that System Integrity Protection is currently active on the host. This status indicates that the core OS protections are enforced, preventing unauthorized modification of system-protected locations and restricted kernel operations. In a GSEC context, confirming the status of SIP is a primary validation step during an incident response or security audit, as disabling SIP is a common technique used by attackers to gain persistence and evade detection on macOS.

Answer

The endpoint is vulnerable to root-level system file modification.

Answer

The disk encryption configuration is currently failing.

Answer

The device has been successfully compromised by a kernel rootkit.

Question 9

An organization is implementing TLS 1.3 for a new customer portal. During the cipher suite negotiation phase, the security engineer needs to ensure that perfect forward secrecy is maintained for all incoming sessions. Which underlying key exchange mechanism should be prioritized in the configuration?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral. Perfect forward secrecy ensures that session keys are not compromised even if the primary private key of the server is compromised in the future. Ephemeral Diffie-Hellman guarantees this by generating unique per-session parameters that are never stored persistently on disk. Proper enforcement prevents long-term bulk decryption of historical intercepted traffic.

Answer

RSA key transport mechanism

Answer

Pre-Shared Key authentication mode

Answer

Static Diffie-Hellman key agreement

Question 10

Refer to the exhibit. An investigator is auditing logon events. Which Event ID indicates a successful network logon (Type 3) to the machine?

Accepted Answer

Event ID 4624 with Logon Type 3. Event ID 4624 records successful logons, and the Logon Type field specifies the method used. A Type 3 logon represents a network connection, often associated with remote file access or service authentication. Identifying these events is essential for detecting lateral movement or unauthorized access via SMB, as attackers frequently use network logons to propagate through a compromised environment using stolen credentials.

Answer

Event ID 4625

Answer

Event ID 4624 with Logon Type 2

Answer

Event ID 4672

Question 11

During a forensic examination, you find a Prefetch file named 'MALWARE.EXE-A1B2C3D4.pf'. What is the significance of the hexadecimal string appended to the filename?

Accepted Answer

It is a hash derived from the file's execution path.. Windows Prefetch files store metadata about application execution to speed up startup times. The hash appended to the filename is calculated based on the path from which the application was executed. This allows investigators to differentiate between multiple instances of the same binary running from different directories, which is a common technique used by attackers to hide malicious binaries in non-standard, obfuscated system locations.

Answer

It is a randomized identifier generated at system boot.

Answer

It represents the hash of the file's content.

Answer

It is the timestamp of the last execution.

Question 12

An organization is migrating to a hybrid cloud environment. Which security control is most effective for preventing unauthorized lateral movement between virtual machines residing on the same physical hypervisor?

Accepted Answer

Utilizing micro-segmentation policies via distributed firewalls.. Micro-segmentation is critical in virtualized environments because traditional network perimeter defenses cannot see traffic moving between VMs on the same host. By applying host-based or hypervisor-level firewalls, security teams restrict traffic based on identity and function rather than IP address. This mitigates the risk of a compromised workload pivoting to sensitive internal assets within the shared virtual infrastructure, which is a key security requirement for modern cloud architectures.

Answer

Deploying a Network Intrusion Detection System (NIDS) at the virtual switch level.

Answer

Implementing a traditional hardware-based firewall at the edge of the datacenter.

Answer

Enforcing full disk encryption on all virtual hard drives.

Question 13

After a major security breach, the incident response team conducts a lessons-learned meeting. The team identifies that the initial detection was delayed because log sources were not properly integrated into the SIEM. Which phase of the incident response lifecycle does this finding primarily aim to improve?

Accepted Answer

Preparation. The finding that log sources were not integrated into the SIEM points to a gap in preparation. Preparation involves setting up logging, monitoring, and detection tools. By addressing this, the team enhances future detection capabilities. While the review occurs in Post-Incident Activity, the corrective action targets Preparation.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 14

A penetration tester is reviewing the TLS configuration of an e-commerce web server. The tester observes that the server prefers the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA during the handshake. Which security weakness does this cipher suite selection introduce?

Accepted Answer

It lacks forward secrecy because the RSA key exchange does not generate ephemeral session keys.. The cipher suite TLS_RSA_WITH_AES_128_CBC_SHA relies on static RSA key exchange, where the client encrypts a premaster secret with the server's public key. This means the session key is tied to the server's long-term private key. If that private key is compromised later, an attacker who recorded the encrypted session can decrypt it retroactively. Forward secrecy requires ephemeral key exchanges like ECDHE or DHE, which generate unique session keys that are not recoverable from the long-term key.

Answer

It uses AES in CBC mode, which is vulnerable to padding oracle attacks such as POODLE.

Answer

It uses SHA-1 for integrity, which is considered cryptographically broken for MACs.

Answer

It allows downgrade to export-grade cryptography because of the RSA key exchange.

Question 15

A security analyst is reviewing logs from a Linux web server that has been compromised. The analyst notices a large number of requests to a specific URL that include encoded characters such as %27, %20, and %3D. The web server logs show these requests in the access log with a 200 OK response. Which type of attack is most likely indicated by these log entries?

Accepted Answer

SQL injection. The encoded characters %27 (single quote), %20 (space), and %3D (equals) are commonly used in SQL injection attempts to manipulate SQL queries. The single quote is used to terminate strings, spaces separate SQL keywords, and equals signs are used in comparisons. The successful 200 OK responses suggest the application may be vulnerable. Other attack types would exhibit different patterns in the logs.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

Command injection

Question 16

A security analyst is reviewing a web application's HTTP response headers and notices the following header: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'. The analyst is concerned about the application's resilience to cross-site scripting (XSS). Which of the following best describes the security implication of this policy?

Accepted Answer

The policy is insecure because it allows inline scripts, which can be exploited by XSS attacks.. The Content-Security-Policy header includes 'unsafe-inline' in the script-src directive, which permits inline JavaScript execution. This directly undermines CSP's ability to prevent XSS attacks, as injected inline scripts will run. The correct answer identifies that allowing inline scripts makes the policy insecure. The other options incorrectly focus on external script restrictions or reporting, missing the critical weakness.

Answer

The policy is insecure because it lacks a report-uri directive, so violations cannot be monitored.

Answer

The policy is secure because default-src 'self' prevents loading scripts from external domains, mitigating XSS.

Answer

The policy is secure because it restricts scripts to the same origin and disallows inline scripts.

Question 17

A healthcare provider is designing a defense in depth strategy for its electronic health record (EHR) system. The security architect proposes using a different vendor's endpoint detection and response (EDR) product, a different firewall brand, and a different SIEM platform than those used by the rest of the organization. The CIO asks why heterogeneous controls are preferred over standardizing on a single vendor. Which statement best justifies the architect's recommendation?

Accepted Answer

Using different vendors ensures that a single exploit or misconfiguration cannot simultaneously compromise all layers of defense.. Heterogeneous security controls create independent failure domains. If one vendor's product has a vulnerability or is misconfigured, the others are unlikely to share the same flaw, so a single exploit cannot disable all layers. This diversity strengthens defense in depth by preventing common-mode failures, which is the architect's core justification for mixing vendors in the EHR environment.

Answer

Heterogeneous controls reduce licensing costs because multiple vendors compete for the same functionality.

Answer

Different vendors provide more comprehensive log formats that are easier to correlate in the SIEM.

Answer

Heterogeneous controls are required by HIPAA for any system that stores electronic protected health information.

Question 18

An administrator observes unauthorized devices connecting to an enterprise wireless network using WPA2-Personal. Which mitigation strategy best prevents credential sharing and ensures unique authentication for every employee?

Accepted Answer

Transition to WPA2-Enterprise utilizing 802.1X authentication with EAP-TLS.. Moving from WPA2-Personal to WPA2-Enterprise (802.1X) forces each user to authenticate against a central RADIUS server using unique credentials. This eliminates the risk of shared PSKs, which are easily compromised when employees leave or share them. This transition is a foundational requirement for securing enterprise wireless environments and ensuring accountability through centralized logging and per-user access control.

Answer

Implement MAC address filtering on all wireless access points.

Answer

Increase the PSK complexity to a 64-character alphanumeric string.

Answer

Enable hidden SSIDs to prevent unauthorized discovery.

Question 19

A retail company is adopting the CIS Critical Security Controls and wants to prioritize its efforts. According to the CIS Controls, which of the following is the first basic control that should be implemented to gain visibility into assets?

Accepted Answer

Inventory and Control of Enterprise Assets. Inventory and Control of Enterprise Assets is the first CIS Control because it establishes the foundation for all other controls. You cannot protect what you do not know exists. An accurate asset inventory enables effective vulnerability management, privilege control, and incident response. The CIS Controls are prioritized, with Control 1 as the starting point for any organization.

Answer

Email and Web Browser Protections

Answer

Continuous Vulnerability Management

Answer

Controlled Use of Administrative Privileges

Question 20

A retail company runs a stateful firewall at its internet edge. Users complain that long-lived SSH sessions to a partner are being dropped roughly every hour even though no idle timeout is configured on the client. Which firewall behavior is the MOST likely cause?

Accepted Answer

The firewall's TCP session table entry is expiring because the connection has been idle longer than the configured state timeout.. Stateful inspection maintains a session table whose entries expire according to protocol idle timers. An SSH connection that sends no data for the duration of the TCP established timeout is silently removed, after which the firewall no longer recognizes return packets as part of an existing flow and drops them.

Answer

The firewall is applying egress filtering that blocks the partner's return traffic after the first hour.

Answer

The firewall is performing full packet reassembly and rejecting out-of-order TCP segments from the partner.

Answer

The firewall's ALG for SSH is rewriting the sequence numbers and desynchronizing the endpoints.