GSEC Practice Test 9 — 10 Questions

Question 1

A security administrator needs to ensure that a newly created script, 'cleanup.sh', can only be executed by the file owner, while preventing any other users from reading or writing the file. Which command achieves this configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

chmod 700 cleanup.sh. The chmod command with the octal value 700 applies read, write, and execute permissions exclusively to the owner (7), while setting no permissions for the group (0) and others (0). This follows the principle of least privilege by isolating the script's execution to the authorized user. Restricting access is critical in Linux security to prevent unauthorized execution of potentially sensitive maintenance utilities by standard users or attackers.

Answer

chmod 777 cleanup.sh

Answer

chmod 755 cleanup.sh

Answer

chmod 600 cleanup.sh

Question 2

When configuring endpoint security, which THREE of the following are considered 'defense-in-depth' measures to protect against ransomware?

Accepted Answer

Applying the Principle of Least Privilege (PoLP) to user file shares.. Defense-in-depth requires multiple layers of security to ensure that if one control fails, others are present to mitigate the impact. For ransomware, this includes preventing the execution, limiting the scope of damage through permissions, and maintaining immutable backups. These layers ensure that an attacker must overcome multiple, diverse obstacles to achieve their objective of data encryption, significantly increasing the difficulty of a successful attack.

Answer

Disabling all network connections to the endpoint.

Answer

Enabling guest access for easier file sharing across departments.

Question 3

An administrator is reviewing system logs to identify potential unauthorized access attempts. Which TWO commands are commonly used to view the last few lines of a log file in real-time?

Accepted Answer

tail -f /var/log/auth.log. Monitoring logs in real-time is a fundamental skill for GSEC professionals to detect ongoing attacks or system errors. The 'tail -f' command is the standard utility for following a file's growth. Alternatively, 'less +F' offers a more robust interface that allows the admin to toggle between real-time monitoring and static analysis, providing better flexibility when investigating complex log entries during an active incident response scenario.

Answer

head -n 20 /var/log/auth.log

Answer

cat /var/log/auth.log | grep -v 'accepted'

Answer

more /var/log/auth.log

Question 4

Refer to the exhibit. A network administrator applies this ACL to a router interface. A user from the 192.168.1.0/24 subnet attempts to access the web server at 10.0.5.5 on port 80. What is the result of this traffic flow?

Accepted Answer

The traffic is denied because the first rule matches and terminates evaluation.. Cisco standard and extended ACLs process rules sequentially from top to bottom. The first rule explicitly denies any IP traffic to the host 10.0.5.5 on port 80. Because this deny rule is matched first, the router immediately drops the packet before evaluating subsequent lines. Even though the second rule would have permitted the traffic, it is unreachable due to the specificity and position of the initial deny statement.

Answer

The traffic is permitted because the second rule matches the source subnet.

Answer

The traffic is permitted because permit rules take precedence over deny rules.

Answer

The router generates an error because the ACL rules are contradictory.

Question 5

An administrator needs to harden a corporate switch infrastructure against unauthorized device connections and Man-in-the-Middle attacks. Which combination of Layer 2 security controls provides the most comprehensive defense against both DHCP spoofing and ARP poisoning?

Accepted Answer

Deploying Dynamic ARP Inspection paired with an active DHCP Snooping binding table.. DHCP Snooping builds a trusted binding database by intercepting DHCP messages on untrusted ports, while Dynamic ARP Inspection utilizes this database to drop forged ARP replies. Implementing both mitigates rogue DHCP servers and prevents ARP cache poisoning attacks, securing Layer 2 communications from interception and spoofing without relying solely on static configurations.

Answer

Implementing Port Security along with Static ARP entries on all critical endpoints.

Answer

Enabling BPDU Guard and Root Guard on all designated edge access ports.

Answer

Configuring VLAN Access Control Lists alongside private VLAN isolated port modes.

Question 6

You are hardening a Windows environment and must restrict the use of PowerShell to only digitally signed scripts. Which command should you execute?

Accepted Answer

Set-ExecutionPolicy AllSigned. Setting the execution policy to 'AllSigned' forces the system to verify that every script has been signed by a trusted publisher. This is a fundamental security control that prevents the execution of unauthorized or tampered scripts. Implementing this policy significantly reduces the attack surface for fileless malware that relies on unconstrained execution of PowerShell commands and scripts.

Answer

Set-ExecutionPolicy RemoteSigned

Answer

Set-ExecutionPolicy Unrestricted

Answer

Set-ExecutionPolicy Bypass

Question 7

Which component of the Windows Security Infrastructure is responsible for checking the user's token against the Security Descriptor of an object to authorize access?

Accepted Answer

Security Reference Monitor (SRM). The Security Reference Monitor (SRM) is the core component within the Windows executive that enforces security policies. It performs the critical task of Access Check, comparing the user's security token against the object's Discretionary Access Control List (DACL). Understanding this mechanism is fundamental for any security professional, as it is the final gatekeeper for every single request to access files, registry keys, or services on a Windows system.

Answer

Local Security Authority (LSA)

Answer

Security Account Manager (SAM)

Answer

Active Directory Domain Services (AD DS)

Question 8

Refer to the exhibit. Which configuration setting poses the most significant risk to the wireless network environment?

Accepted Answer

WPS enabled allows for PIN-based brute-force attacks.. The exhibit shows WPS enabled on a WPA2-PSK network. WPS is notoriously vulnerable to brute-force attacks against its 8-digit PIN, which can be cracked in hours, revealing the underlying WPA2 passphrase. Disabling WPS is a standard security requirement because the protocol's design flaw allows for efficient recovery of the network key regardless of the passphrase's complexity, rendering the PSK security model entirely ineffective.

Answer

Channel 1 selection is a performance concern.

Answer

WPA2-PSK is insufficient for modern enterprise needs.

Answer

Management Frame Protection is disabled.

Question 9

An administrator wants to prevent unauthorized modification of Windows Services. Which tool allows for the centralized management of service startup types and logon accounts across multiple domain-joined systems?

Accepted Answer

Group Policy Management Console (GPMC). Group Policy Objects (GPO) are the standard mechanism in Windows environments to enforce security configurations, including service management, across an entire fleet. Centralized control ensures that security policies are applied consistently, preventing configuration drift and unauthorized changes that could be exploited by attackers. By leveraging GPOs, administrators can maintain a hardened baseline, which is a foundational requirement for both GIAC compliance standards and general enterprise cybersecurity best practices.

Answer

Task Scheduler

Answer

Services.msc

Answer

Local Security Policy (secpol.msc)

Question 10

A security analyst is examining a web application that uses HTTP Strict Transport Security (HSTS). The analyst notices that the HSTS header is only sent on HTTPS responses and includes the 'preload' directive. Which additional measure must be taken to ensure the domain is included in browser preload lists?

Accepted Answer

Submit the domain to the HSTS preload list maintained by Google, and ensure the header includes 'includeSubDomains' and a max-age of at least one year.. To preload HSTS, the domain must meet strict criteria: the HSTS header must include 'includeSubDomains', 'preload', and a max-age of at least one year. The 'preload' directive alone does not trigger automatic inclusion; the domain must be submitted to the preload list service. Once accepted, browsers hardcode the domain, enforcing HTTPS even on the first visit. This prevents SSL stripping attacks during initial connections.

Answer

Ensure the HSTS header is sent with a max-age of at least six months and includes the 'preload' directive, then submit the domain to the preload list.

Answer

Configure the server to redirect all HTTP requests to HTTPS with a 301 status code and include the HSTS header in the redirect response.

Answer

Add the 'preload' directive to the HSTS header and wait for browsers to automatically discover and add the domain to their preload lists.