GSEC Practice Test 7 — 10 Questions

Question 1

A security administrator is reviewing the access control model used by a Windows Server 2022 domain controller. They need to ensure that when a user logs on, the system evaluates the user's group memberships and generates a data structure that is used for all subsequent access checks. Which component is responsible for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access Token. During interactive or network logon, the Local Security Authority (LSA) authenticates the user and creates an access token. This token includes the user's SID, the SIDs of all groups the user belongs to, and any privileges assigned. The token is then used by the Security Reference Monitor for all access checks against securable objects. Therefore, the access token is the correct component.

Answer

Group Policy Object (GPO)

Answer

Security Descriptor

Answer

Security Identifier (SID)

Question 2

A web developer is implementing a new session management system and wants to ensure that session cookies are not accessible via JavaScript to mitigate cross-site scripting (XSS) attacks. Which cookie attribute should be set?

Accepted Answer

HttpOnly. The HttpOnly attribute is specifically designed to prevent client-side scripts from accessing cookies. By setting HttpOnly, the cookie is protected from theft via XSS attacks that execute JavaScript in the victim's browser. The other attributes serve different purposes: Secure ensures HTTPS transmission, SameSite mitigates CSRF, and Domain controls cookie scope. Only HttpOnly directly addresses the requirement.

Answer

SameSite

Answer

Domain

Answer

Secure

Question 3

A security team is implementing a SIEM and needs to ensure that log sources are properly normalized and enriched to support effective correlation and alerting. Which TWO of the following tasks are essential for achieving this goal? (Choose two.)

Accepted Answer

Enriching events with contextual data, such as asset criticality, user identity, and geolocation, from external sources.. Normalization and enrichment are critical for SIEM effectiveness. Mapping fields to a common schema like the Splunk CIM ensures consistent field names for correlation. Enriching with context such as asset criticality and geolocation improves alert accuracy and prioritization. These two tasks together enable the SIEM to correlate events across diverse sources and generate meaningful alerts.

Answer

Configuring the SIEM to drop logs that do not match the expected format to reduce noise.

Answer

Storing all raw logs indefinitely in their original format without normalization.

Answer

Increasing the SIEM's indexing speed by disabling timestamp recognition on all logs.

Question 4

A security analyst is reviewing the update history of a Windows 10 Enterprise device managed by Windows Update for Business (WUfB). The analyst notices that a critical security update was installed 30 days after its release, even though no deferral policies were configured. Which factor is the most likely cause for the delayed installation?

Accepted Answer

The device was offline or in sleep mode during the update's initial release period.. The most likely cause is that the device was offline or inactive during the update's release. WUfB does not force immediate installation; it relies on the device being on and connected to download and install updates. Without deferral policies, updates are offered as soon as they are released, but installation depends on device availability. A 30-day delay aligns with a device that was not used or connected for an extended period, after which it received the update upon becoming active.

Answer

The device was configured to use a Windows Update for Business deferral for quality updates.

Answer

The update was blocked by a Windows Defender Application Control (WDAC) policy.

Answer

The update was not approved in Windows Server Update Services (WSUS).

Question 5

A security engineer is hardening a Windows Server 2022 environment that hosts several critical services. The engineer wants to implement measures to protect against credential theft and privilege escalation via service accounts. Which two of the following actions should the engineer take? (Choose two.)

Accepted Answer

Implement a policy to regularly audit service accounts for excessive privileges and remove unnecessary rights, such as 'Act as part of the operating system' or 'Debug programs'.. The correct actions are to deploy gMSAs for domain-authenticated services and to audit and reduce service account privileges. gMSAs provide automatic password management and reduce credential theft risk. Auditing privileges ensures least privilege and removes dangerous rights. The other options either increase risk by granting excessive privileges or weaken security through reversible encryption or overly broad logon rights.

Answer

Assign the 'Log on as a service' right to all domain users to ensure that any service can start without interruption.

Answer

Configure all services to run under the Local System account to simplify management and ensure they have the necessary privileges.

Answer

Enable the 'Store passwords using reversible encryption' policy for all service accounts to allow easy recovery of passwords if needed.

Question 6

A company uses Microsoft Entra ID (formerly Azure AD) and has a critical line-of-business application that authenticates users via SAML 2.0. The security team wants to enforce multi-factor authentication (MFA) for this application without affecting other applications. They have Entra ID P1 licenses. What is the most appropriate way to achieve this?

Accepted Answer

Configure a Conditional Access policy that targets the specific application and requires MFA for all users.. Conditional Access policies in Entra ID allow administrators to enforce MFA for specific applications and users. This is the most granular and appropriate method when you have Entra ID P1 licenses. Security defaults apply tenant-wide, the per-application MFA setting is deprecated, and authentication method policies do not enforce MFA per application. Therefore, the correct solution is to create a Conditional Access policy targeting the line-of-business application.

Answer

Set up a per-application MFA setting in the Enterprise Applications blade by enabling the 'Require multi-factor authentication' option for the specific application.

Answer

Create a new authentication method policy that restricts MFA to only the users who need access to the application.

Answer

Enable security defaults in Entra ID, which will automatically enforce MFA for all users and applications.

Question 7

When investigating a Windows system, which file system feature is responsible for recording the file metadata including timestamps for created, modified, and accessed (MACE) times?

Accepted Answer

Master File Table (MFT). The Master File Table (MFT) is the core of the NTFS file system. Every file on an NTFS volume has at least one entry in the MFT. These entries contain the MACE times, which are critical for building a timeline of events. If these times are altered, it often indicates anti-forensic activity, making the MFT the primary source for verifying file history and integrity during an investigation.

Answer

Registry hives

Answer

Event Logs

Answer

Prefetch files

Question 8

A security analyst is investigating a macOS Monterey system that may have been compromised. The analyst wants to check for signs of malicious kernel extensions. Which TWO of the following commands or tools are most appropriate for this task? (Choose two.)

Accepted Answer

kmutil showloaded. To check for malicious kernel extensions, an analyst should use tools that list loaded kexts. The kextstat command provides a list of loaded kernel extensions, while kmutil showloaded offers similar information with more detail. Both are appropriate for identifying unauthorized kexts. The other commands focus on system extensions, SIP status, or Gatekeeper assessments, which do not directly reveal loaded kernel extensions.

Answer

spctl --assess --verbose

Answer

systemextensionsctl list

Answer

csrutil status

Question 9

A security analyst is reviewing file server permissions and notices that a user, Elena, has the 'Modify' permission on a folder via group membership in 'Project_X', but she is also a member of the 'Contractors' group, which has an explicit 'Deny' for 'Write'. Elena reports she cannot edit any files in the folder. What is the most likely explanation for this behavior?

Accepted Answer

The 'Deny' permission for the 'Contractors' group takes precedence over the 'Allow' permission inherited from 'Project_X'.. Windows access control evaluates Deny entries before Allow entries. An explicit Deny for a group applies to all its members, and it overrides any Allow permissions, even those granted through other group memberships or inheritance. Thus, Elena's Write access is blocked by the Deny on the Contractors group, despite her Modify permission from Project_X.

Answer

The 'Deny' permission only applies if Elena is directly listed, not via group membership.

Answer

The 'Write' permission is not included in the 'Modify' permission, so the Deny for Write does not affect Modify.

Answer

The 'Modify' permission from 'Project_X' is inherited and therefore is overridden by the explicit 'Deny'.

Question 10

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Accepted Answer

Resetting compromised user passwords. Eradication aims to completely remove the adversary's presence. Simply deleting a file is rarely sufficient; attackers often leave multiple persistence mechanisms or backdoors. By resetting credentials, patching the underlying vulnerability, and re-imaging systems, the organization ensures that the attacker cannot easily return, effectively closing the window of opportunity that allowed the initial unauthorized access to occur and persist.

Answer

Analyzing the memory dump for malware signatures

Answer

Drafting an incident report for executive leadership