GSEC Access Control and Password Management — All Questions With Answers

Question 1

An organization requires that users authenticate via a smart card and a PIN to access secure network resources. Which access control model is being enforced?

Accepted Answer

Multifactor Authentication. This scenario describes multifactor authentication, which is a core component of strong access control. By requiring both a physical possession factor (smart card) and a knowledge factor (PIN), the organization achieves higher assurance. Access control models rely on these mechanisms to verify identity before authorization decisions are made, ensuring that only authenticated users can interact with sensitive system assets and data, reducing the risk of unauthorized access through credential theft.

Answer

Role-Based Access Control

Answer

Discretionary Access Control

Answer

Mandatory Access Control

Question 2

Refer to the exhibit. An administrator applies this JSON policy to an S3 bucket. What is the intended effect of this access control policy?

Accepted Answer

It enforces encryption in transit for S3 objects. This policy enforces encryption in transit by explicitly denying any s3:GetObject request that is not sent over a secure, encrypted connection (HTTPS). By checking the aws:SecureTransport condition key, the policy ensures that unencrypted traffic is rejected regardless of any other permissions granted to the user. This is a critical security control for protecting sensitive data from interception while being transmitted across the network between the client and the cloud storage.

Answer

It restricts access to specific IP addresses

Answer

It grants public read access to the bucket

Answer

It prevents bucket deletion by unauthorized users

Question 3

Which TWO of the following are considered 'something you are' authentication factors?

Accepted Answer

Retina scan. Biometric factors rely on the physical or behavioral characteristics of an individual to verify identity. These factors are unique to the person and provide a high level of assurance. In access control, these are often used in conjunction with other factors to implement robust multifactor authentication, ensuring that the person requesting access is who they claim to be based on intrinsic biological features rather than items they possess or know.

Answer

Hardware token

Answer

Security question

Answer

Digital certificate

Question 4

A system administrator implements a policy where users can only access the server room during their scheduled shifts. Which type of access control is this?

Accepted Answer

Attribute-Based Access Control. This is an example of context-aware access control, specifically temporal or time-based access control. By restricting access based on the time of day, the organization limits the window of opportunity for an attacker or an insider to perform unauthorized activities. This adds a layer of defense-in-depth, ensuring that system resources are only accessed during authorized business hours, reducing the risk of malicious activity occurring when the building or office is empty.

Answer

Role-Based Access Control

Answer

Discretionary Access Control

Answer

Mandatory Access Control

Question 5

Refer to the exhibit. Based on the error log, why was the request denied?

Accepted Answer

The user lacks the required permission for the action. The error occurs because the user 'jdoe' belongs to a group with only 'Read Only' permissions, which does not include the 's3:PutObject' action required to upload or write a file. Access control systems follow the principle of least privilege, and since the user lacked the specific permission to modify the object, the request was rejected. This highlights the importance of correct group-to-permission mapping in managing enterprise access control policies effectively.

Answer

The user is not authenticated

Answer

The resource path is incorrect

Answer

The system is undergoing maintenance

Question 6

A security engineer is configuring a Linux server that hosts a shared financial application. The company's access control policy mandates that authentication and authorization decisions be made by a central server, and that users be granted access based on their role in the finance department. The engineer installs and configures the SSSD daemon to integrate with the corporate LDAP directory. Which access control model is being implemented?

Accepted Answer

Role-Based Access Control (RBAC). The central LDAP directory stores user attributes, including department or role, and SSSD enforces access based on those roles. This is the defining characteristic of Role-Based Access Control, where permissions are assigned to roles and users are assigned to roles. The other models do not rely on directory-based role assignments for centralized authorization.

Answer

Mandatory Access Control (MAC)

Answer

Rule-Based Access Control (RuBAC)

Answer

Discretionary Access Control (DAC)

Question 7

A security administrator is configuring a Linux server to enforce a password policy that locks an account for 30 minutes after five failed login attempts within a 10-minute window. The administrator wants to avoid locking out the root account to prevent accidental denial of service. Which file should be edited to apply these settings?

Accepted Answer

/etc/pam.d/system-auth or /etc/pam.d/common-auth, depending on distribution. The correct file is the PAM configuration file for authentication, typically /etc/pam.d/system-auth or /etc/pam.d/common-auth. These files define the authentication stack where modules like pam_faillock or pam_tally2 are invoked. By adding parameters such as deny=5 and unlock_time=1800, and using even_deny_root or excluding root, the administrator can enforce the lockout policy while protecting the root account. Other files control different aspects of password and login policy.

Answer

/etc/login.defs

Answer

/etc/securetty

Answer

/etc/security/pwquality.conf

Question 8

A user reports that they are unable to log into their workstation after returning from vacation. The help desk verifies that the user's account is not locked out and the password has not expired. Which of the following is the most likely cause?

Accepted Answer

The user's account has been disabled.. The help desk confirmed the account is not locked out and the password has not expired. The most likely remaining cause for a login failure is that the account has been disabled. Disabled accounts cannot log in regardless of correct credentials. Other options like wrong password, clock skew, or password expiration are either ruled out by the scenario or less likely given the specific user and verified conditions.

Answer

The user's password has expired.

Answer

The workstation's clock is out of sync.

Answer

The user is typing the wrong password.

Question 9

Which password management practice best minimizes the impact of a credential stuffing attack?

Accepted Answer

Enforcing unique passwords per service. Credential stuffing relies on users reusing the same passwords across multiple services. By enforcing unique, complex passwords for every single account, users ensure that a compromise at one service does not lead to a cascade of compromises elsewhere. This is the single most effective defense against automated attacks that attempt to use leaked database dumps to gain unauthorized access to other unrelated accounts held by the same user.

Answer

Mandating password changes every 30 days

Answer

Requiring a minimum password length of 8 characters

Answer

Disabling account lockout after failed attempts

Question 10

Which of the following describes the 'Principle of Least Privilege' in an access control context?

Accepted Answer

Providing users only the access required to complete their tasks. The Principle of Least Privilege (PoLP) mandates that users should only be granted the minimum level of access necessary to perform their job functions. This minimizes the attack surface; if a user account is compromised, the potential damage is restricted to the limited permissions assigned to that account. This is a fundamental security concept for preventing lateral movement and privilege escalation during an active incident or breach.

Answer

Granting all employees access to the root directory for troubleshooting

Answer

Using the same shared password for all administrative accounts

Answer

Ensuring all users have administrator rights for software updates

Question 11

What is the primary purpose of Salt in password hashing?

Accepted Answer

To prevent the use of rainbow tables. A salt is a unique, random string added to a password before it is hashed. This ensures that even if two users have the same password, their resulting hashes will be different. This prevents attackers from using pre-computed tables, such as rainbow tables, to quickly reverse the hashes of stolen passwords. By forcing attackers to calculate hashes for each individual user, the salt significantly increases the computational cost of brute-force and dictionary attacks.

Answer

To shorten the length of the stored hash

Answer

To increase the complexity of the user's password

Answer

To facilitate easier password recovery

Question 12

A security administrator is reviewing the password policy for a high-security environment. The policy requires the use of a hardware token that generates a one-time password (OTP) based on a secret key and the current time. The administrator notices that some tokens are failing authentication because the server and tokens are not time-synchronized. Which of the following should the administrator implement to ensure the OTPs are validated correctly?

Accepted Answer

Configure a time drift window on the authentication server.. Time-based OTP tokens require the server and token to have closely synchronized clocks. When tokens drift, the server can accept OTPs from adjacent time steps by configuring a time drift window. This is a standard feature in TOTP implementations and directly addresses the authentication failures without replacing hardware or altering token generation.

Answer

Enable NTP synchronization on the authentication server only.

Answer

Switch from time-based to event-based OTP tokens.

Answer

Increase the OTP length to 8 digits.

Question 13

A security team is configuring password policies for a Windows Active Directory domain. They need to enforce a setting that prevents users from reusing any of their last 24 passwords. Which password policy setting should they configure?

Accepted Answer

Enforce password history. The Enforce password history policy setting in Active Directory allows administrators to specify the number of previous passwords that cannot be reused. Setting it to 24 ensures users must choose 24 unique passwords before they can reuse an old one. This directly addresses the requirement to prevent reuse of the last 24 passwords. Other settings like maximum age, minimum age, or complexity do not track password reuse and therefore do not meet the stated goal.

Answer

Minimum password age

Answer

Password must meet complexity requirements

Answer

Maximum password age

Question 14

A security administrator is reviewing authentication logs and notices that an attacker successfully authenticated to a VPN using a valid username and password, but the attacker did not possess the user's hardware token. The VPN is configured to require both a password and a one-time code from a hardware token. Which attack technique most likely allowed the attacker to bypass the hardware token requirement?

Accepted Answer

Man-in-the-middle attack. A man-in-the-middle attack allows an attacker to intercept and relay authentication credentials, including one-time codes, in real time. If the attacker can position themselves between the user and the VPN, they can capture both the password and the token code as they are transmitted. The attacker then uses these to authenticate before the code expires, effectively bypassing the need to physically possess the hardware token. Other attacks like pass-the-hash, credential stuffing, or brute-force do not provide the one-time code.

Answer

Credential stuffing

Answer

Pass-the-hash

Answer

Brute-force attack

Question 15

A security team is implementing a new access control system for a research lab. They need to ensure that access decisions are based on the user's role and the sensitivity of the resource, and that users are only granted the minimum permissions necessary to perform their job. Which two access control principles should they apply? (Choose two.)

Accepted Answer

Principle of Least Privilege. Role-Based Access Control (RBAC) bases access decisions on the user's role, and the principle of least privilege ensures users only have the minimum permissions needed. Together, they meet the requirement to use role and resource sensitivity while enforcing least privilege. DAC, MAC, and rule-based access control do not specifically combine role-based decisions with least privilege in the same way.

Answer

Discretionary Access Control (DAC)

Answer

Rule-Based Access Control

Answer

Mandatory Access Control (MAC)

Question 16

A financial institution is implementing a new access control system for its trading floor. The security team must enforce a model that supports dynamic, fine-grained access decisions based on user attributes, resource attributes, and environmental conditions such as time of day. The system must also allow for centralized policy management and auditing. Which TWO of the following access control models best fit these requirements? (Choose two.)

Accepted Answer

Policy-Based Access Control (PBAC). Attribute-Based Access Control and Policy-Based Access Control both support dynamic, fine-grained access decisions using attributes and environmental conditions. They allow centralized policy management and auditing, which are critical for the financial institution. RBAC, MAC, and DAC lack the necessary flexibility and context-awareness. Therefore, ABAC and PBAC are the correct choices.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 17

A security analyst is reviewing authentication logs and notices that an attacker attempted to log in using a list of previously breached username and password combinations. The attack failed because the organization had implemented a control that requires users to provide a second factor in addition to their password. Which type of attack was mitigated?

Accepted Answer

Credential stuffing. Credential stuffing specifically uses breached username and password pairs to gain unauthorized access. The presence of a second authentication factor prevents the attacker from succeeding even with valid credentials. Other attacks like password spraying, brute force, or rainbow tables do not rely on breached credential lists in the same way. Therefore, the mitigated attack is credential stuffing.

Answer

Rainbow table attack

Answer

Brute force

Answer

Password spraying

Question 18

An organization is deploying a new VPN solution and wants to ensure that authentication credentials are not transmitted in cleartext over the internet. The security team decides to use a protocol that encapsulates authentication within a TLS tunnel. Which protocol should they implement?

Accepted Answer

EAP-TTLS. EAP-TTLS encapsulates authentication within a TLS tunnel, protecting credentials from eavesdropping. PAP sends cleartext, CHAP uses a non-TLS challenge-response, and MS-CHAPv2 lacks TLS encapsulation. Only EAP-TTLS meets the requirement of transmitting authentication securely within a TLS tunnel, making it the correct protocol for the VPN deployment.

Answer

CHAP

Answer

PAP

Answer

MS-CHAPv2

Question 19

A security administrator is configuring a Linux server and needs to enforce that all user passwords are hashed with a strong, salted algorithm. Which file should the administrator edit to set the default password hashing algorithm for new passwords?

Accepted Answer

/etc/login.defs. The /etc/login.defs file contains the ENCRYPT_METHOD setting, which specifies the default password hashing algorithm for new passwords on many Linux distributions. Editing this file allows the administrator to enforce a strong, salted algorithm like SHA512. While /etc/shadow stores hashes and PAM configures authentication, the default algorithm is set in login.defs. Therefore, this is the correct file to edit.

Answer

/etc/pam.d/common-password

Answer

/etc/passwd

Answer

/etc/shadow

Question 20

A security engineer is designing a password hashing scheme for a new application. The scheme must be resistant to GPU-accelerated cracking and allow for tuning of CPU and memory costs. Which hashing algorithm should the engineer choose?

Accepted Answer

Argon2. Argon2 is specifically designed to be memory-hard and CPU-hard, with tunable parameters for time, memory, and parallelism. This makes it resistant to GPU-accelerated cracking and allows customization for different environments. bcrypt and PBKDF2 lack memory tuning, and SHA-256 is too fast. Therefore, Argon2 is the correct choice for the password hashing scheme.

Answer

PBKDF2

Answer

bcrypt

Answer

SHA-256 with a random salt

GSEC Access Control and Password Management — All Questions With Answers

An organization requires that users authenticate via a smart card and a PIN to access secure network resources. Which access control model is being enforced?

Refer to the exhibit. An administrator applies this JSON policy to an S3 bucket. What is the intended effect of this access control policy?

Exhibit

Which TWO of the following are considered 'something you are' authentication factors?

A system administrator implements a policy where users can only access the server room during their scheduled shifts. Which type of access control is this?

Refer to the exhibit. Based on the error log, why was the request denied?

Exhibit

A user reports that they are unable to log into their workstation after returning from vacation. The help desk verifies that the user's account is not locked out and the password has not expired. Which of the following is the most likely cause?

Which password management practice best minimizes the impact of a credential stuffing attack?

Which of the following describes the 'Principle of Least Privilege' in an access control context?

What is the primary purpose of Salt in password hashing?

A security team is configuring password policies for a Windows Active Directory domain. They need to enforce a setting that prevents users from reusing any of their last 24 passwords. Which password policy setting should they configure?

An organization is deploying a new VPN solution and wants to ensure that authentication credentials are not transmitted in cleartext over the internet. The security team decides to use a protocol that encapsulates authentication within a TLS tunnel. Which protocol should they implement?

A security administrator is configuring a Linux server and needs to enforce that all user passwords are hashed with a strong, salted algorithm. Which file should the administrator edit to set the default password hashing algorithm for new passwords?

A security engineer is designing a password hashing scheme for a new application. The scheme must be resistant to GPU-accelerated cracking and allow for tuning of CPU and memory costs. Which hashing algorithm should the engineer choose?

GSEC Access Control and Password Management — All Questions With Answers

An organization requires that users authenticate via a smart card and a PIN to access secure network resources. Which access control model is being enforced?

Refer to the exhibit. An administrator applies this JSON policy to an S3 bucket. What is the intended effect of this access control policy?

Exhibit

Which TWO of the following are considered 'something you are' authentication factors?

A system administrator implements a policy where users can only access the server room during their scheduled shifts. Which type of access control is this?

Refer to the exhibit. Based on the error log, why was the request denied?

Exhibit

A user reports that they are unable to log into their workstation after returning from vacation. The help desk verifies that the user's account is not locked out and the password has not expired. Which of the following is the most likely cause?

Which password management practice best minimizes the impact of a credential stuffing attack?

Which of the following describes the 'Principle of Least Privilege' in an access control context?

What is the primary purpose of Salt in password hashing?

A security team is configuring password policies for a Windows Active Directory domain. They need to enforce a setting that prevents users from reusing any of their last 24 passwords. Which password policy setting should they configure?

An organization is deploying a new VPN solution and wants to ensure that authentication credentials are not transmitted in cleartext over the internet. The security team decides to use a protocol that encapsulates authentication within a TLS tunnel. Which protocol should they implement?

A security administrator is configuring a Linux server and needs to enforce that all user passwords are hashed with a strong, salted algorithm. Which file should the administrator edit to set the default password hashing algorithm for new passwords?

A security engineer is designing a password hashing scheme for a new application. The scheme must be resistant to GPU-accelerated cracking and allow for tuning of CPU and memory costs. Which hashing algorithm should the engineer choose?