GSEC Practice Test 8 — 10 Questions

Question 1

Refer to the exhibit. An administrator applies this policy to a Windows workstation. What is the expected behavior for a user attempting to execute a legitimate application installed in their AppData folder?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application will be blocked from execution.. The policy explicitly defines a 'Deny' rule for the AppData directory. Since the policy mode is set to 'Enforce', the endpoint security engine will block any executable residing in that path. This is a common security practice to prevent the execution of malicious payloads frequently dropped into temporary user directories, though it may inadvertently block legitimate software that installs to the user profile instead of Program Files.

Answer

The application will run normally because AppData is a standard location.

Answer

The application will run, but the activity will be logged for review.

Answer

The system will automatically move the application to Program Files.

Question 2

A security administrator is troubleshooting access issues on a Windows file server. A user, Bob, is a member of the 'Sales' group, which has 'Read & Execute' on a folder. Bob is also a member of the 'Managers' group, which has 'Full Control' on the same folder. However, Bob cannot delete files. What is the most likely cause?

Accepted Answer

The 'Sales' group has an explicit 'Deny' for 'Delete' that overrides the 'Full Control' from 'Managers'.. In Windows ACLs, an explicit Deny entry overrides any Allow permissions, regardless of the source. If the Sales group has a Deny for Delete, Bob's membership in that group triggers the Deny, preventing deletion even though Managers grants Full Control. This is the most plausible explanation given the information.

Answer

The 'Full Control' permission from 'Managers' does not include the 'Delete' permission.

Answer

Bob's user account has an explicit 'Deny' for 'Delete' that is inherited from the parent folder.

Answer

The 'Read & Execute' permission from 'Sales' is more restrictive and overrides the 'Full Control' from 'Managers'.

Question 3

A hospital's billing server runs Windows Server 2019 and stores insurance claim data. The security team wants to add a control that will detect unauthorized modification of the claim files even if an attacker gains administrative access to the operating system. Which control best meets this requirement?

Accepted Answer

Implement file integrity monitoring (FIM) using SHA-256 hashes of the claim files and schedule regular baseline comparisons.. Detecting unauthorized modification of stored data requires a mechanism that can prove whether contents changed, regardless of the attacker's privilege level. Hash-based file integrity monitoring establishes a trusted baseline and alerts on any deviation, which is exactly what the hospital needs. Encryption and auditing address confidentiality and visibility respectively, and neither produces cryptographic evidence of tampering.

Answer

Configure Windows Audit Policy to log all file access events to the Security event log.

Answer

Enable Windows BitLocker full-disk encryption on the billing server's data volume.

Answer

Deploy a host-based intrusion prevention system (HIPS) that blocks suspicious process execution on the billing server.

Question 4

A security analyst is reviewing a network diagram and sees a device placed between the internet edge router and the internal firewall. The device is described as providing network address translation and stateful connection tracking but not deep application inspection. Which device type is most consistent with this description?

Accepted Answer

A stateful firewall that tracks TCP sessions and allows return traffic for established connections.. Stateful connection tracking and network address translation are core functions of a traditional stateful firewall, which maintains a session table and allows return traffic for established flows. The scenario explicitly excludes deep application inspection, ruling out a next-generation firewall. Stateless filtering lacks connection state, and a web proxy is application-specific rather than a general stateful gateway, so the stateful firewall is the correct device type.

Answer

A stateless packet-filtering router that evaluates each packet independently against ACLs.

Answer

A next-generation firewall that performs full application-layer inspection and user identity mapping.

Answer

A web proxy that terminates HTTP and HTTPS connections and enforces content policies.

Question 5

Which of the following describes the 'Principle of Least Privilege' in an access control context?

Accepted Answer

Providing users only the access required to complete their tasks. The Principle of Least Privilege (PoLP) mandates that users should only be granted the minimum level of access necessary to perform their job functions. This minimizes the attack surface; if a user account is compromised, the potential damage is restricted to the limited permissions assigned to that account. This is a fundamental security concept for preventing lateral movement and privilege escalation during an active incident or breach.

Answer

Granting all employees access to the root directory for troubleshooting

Answer

Using the same shared password for all administrative accounts

Answer

Ensuring all users have administrator rights for software updates

Question 6

A security team is designing a resilient perimeter architecture to protect internal services from distributed denial of service attacks and web application exploits. Which THREE architectural components must be incorporated into this design? (Choose THREE)

Accepted Answer

A dedicated web application firewall to inspect HTTP and HTTPS traffic for application-layer vulnerabilities and injection attacks.. A robust perimeter defense requires multiple layers of inspection and mitigation. Web application firewalls inspect application-layer HTTP and HTTPS traffic to block injection attacks, hardware DDoS mitigation scrubbing centers absorb volumetric network floods upstream, and redundant boundary firewalls enforce stateful perimeter access control policies while eliminating single points of failure.

Answer

Unmanaged Layer-1 hubs placed directly outside the perimeter firewall to mirror raw traffic into analysis buffers.

Answer

Disabling all stateful inspection engines on perimeter firewalls to maximize throughput for inbound HTTPS sessions.

Question 7

Which THREE of the following are examples of how network segmentation supports the principle of defense in depth?

Accepted Answer

It restricts lateral movement for an attacker who has compromised a device.. Network segmentation breaks a flat network into smaller, isolated subnets. This limits the blast radius of a breach by preventing lateral movement, restricting access to sensitive data, and providing points to inspect traffic between zones. By enforcing boundaries, the organization ensures that an attacker who compromises a workstation in one zone cannot easily pivot to critical servers in another, thus creating multiple functional barriers that the attacker must overcome to reach the high-value targets.

Answer

It eliminates the need for host-based firewalls on individual servers.

Answer

It automatically encrypts all data in transit between segments.

Question 8

Which concept describes the use of security controls that operate at the perimeter, network, host, application, and data layers to protect an organization?

Accepted Answer

Defense in Depth. This approach is the definition of defense in depth, which utilizes multiple layers of security across the entire IT stack. By distributing controls across these distinct layers, an organization ensures that there are multiple obstacles between an attacker and the sensitive data. This holistic coverage is essential because attackers often use multi-stage campaigns, and having defenses at every level allows for detection and interception at different phases of the attack lifecycle.

Answer

Zero Trust Architecture

Answer

Security Information and Event Management (SIEM)

Answer

Privileged Access Management (PAM)

Question 9

Which TWO of the following are primary objectives of implementing a defense in depth strategy in a corporate environment?

Accepted Answer

To increase the difficulty and cost for an attacker to succeed.. Defense in depth aims to delay attackers, increase the probability of detection, and ensure that a single point of failure does not lead to a total security compromise. These objectives are achieved by creating layers that require an attacker to defeat multiple, distinct security measures. This approach is essential for modern enterprises where perimeter defenses can be bypassed via phishing or zero-day vulnerabilities, making internal detection and mitigation capabilities absolutely vital.

Answer

To eliminate the need for regular security patching.

Answer

To replace the requirement for user security awareness training.

Answer

To centralize all logs into a single storage location.

Question 10

When selecting a cryptographic hash function for verifying file integrity, which property is most important to ensure that an attacker cannot create two different files that produce the same hash value?

Accepted Answer

Collision resistance.. Collision resistance is the property of a hash function that makes it computationally infeasible to find two distinct inputs that result in the same output hash. This is critical for integrity verification; if an attacker could generate a malicious file with the same hash as a legitimate file, they could bypass security controls, leading to the execution of arbitrary, potentially malicious code while the system assumes the file is authentic and untampered.

Answer

Pre-image resistance.

Answer

Reversibility.

Answer

High computational speed.