GSEC Defense in Depth — 15 Questions

Question 1

An enterprise network implements perimeter firewalls, host-based firewalls, internal VLAN segmentation, and endpoint detection agents. Despite this multi-layered defense, an attacker successfully exfiltrates data through an unmonitored external cloud storage provider via standard HTTPS. Which security control principle was primarily neglected in this defense-in-depth architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforcing Cloud Access Security Broker capabilities with comprehensive egress traffic visibility and data loss prevention policies. A comprehensive defense-in-depth strategy requires continuous monitoring of egress traffic alongside ingress filtering. While perimeter and host controls were deployed, the lack of data loss prevention and outbound protocol inspection allowed unauthorized cloud data transfers to bypass the layered controls undetected.

Answer

Deploying a third perimeter firewall to add redundancy to the external gateway boundary

Answer

Implementing strict egress filtering and content inspection for all outbound TLS traffic

Answer

Upgrading host-based intrusion detection agents to isolate the compromised workstation automatically

Question 2

An organization implements firewalls, intrusion detection systems, and disk encryption. Which principle best describes the deployment of multiple, overlapping security controls to protect critical assets?

Accepted Answer

Defense in Depth. Defense in depth uses layered security to ensure that if one control fails, others remain to mitigate risk. This strategy is critical because no single security measure is foolproof against sophisticated attackers. By diversifying controls across network, host, and data layers, the organization increases the attacker's workload and reduces the probability of a successful breach, ensuring that failures in one area do not lead to a catastrophic compromise of sensitive information.

Answer

Least Privilege

Answer

Security through Obscurity

Answer

Fail-Safe Defaults

Question 3

Which TWO of the following are primary objectives of implementing a defense in depth strategy in a corporate environment?

Accepted Answer

To increase the difficulty and cost for an attacker to succeed.. Defense in depth aims to delay attackers, increase the probability of detection, and ensure that a single point of failure does not lead to a total security compromise. These objectives are achieved by creating layers that require an attacker to defeat multiple, distinct security measures. This approach is essential for modern enterprises where perimeter defenses can be bypassed via phishing or zero-day vulnerabilities, making internal detection and mitigation capabilities absolutely vital.

Answer

To eliminate the need for regular security patching.

Answer

To replace the requirement for user security awareness training.

Answer

To centralize all logs into a single storage location.

Question 4

Which of the following represents an example of applying defense in depth at the host level?

Accepted Answer

Configuring local host firewalls and endpoint detection and response (EDR) software.. Host-level defense in depth involves implementing multiple security controls directly on individual servers or workstations to create a resilient environment. If an attacker bypasses the network perimeter, host-based controls like EDR and local firewalls provide the final barrier. This multi-faceted approach ensures that even if a network segment is compromised, the specific endpoint remains protected and monitored, preventing widespread damage and aiding in rapid incident response and threat isolation.

Answer

Installing a web application firewall at the network edge.

Answer

Implementing multi-factor authentication for corporate VPN access.

Answer

Deploying a network intrusion detection system (NIDS) in promiscuous mode.

Question 5

When designing a defense in depth strategy, why is it recommended to use heterogeneous security controls rather than homogeneous ones?

Accepted Answer

To ensure that a single vulnerability does not bypass all defense layers.. Heterogeneous controls provide diversity, ensuring that a single flaw or vulnerability in one vendor's product does not compromise the entire defense. In a homogeneous environment, if an attacker discovers a bypass for one control, they can apply that same technique across all layers. Using different technologies or vendors increases the probability that at least one layer will successfully stop the threat, thereby making the overall environment significantly more resilient against targeted attacks.

Answer

To reduce the overall cost of software licensing and maintenance.

Answer

To simplify the process of configuring and managing security logs.

Answer

To minimize the need for external security audits and compliance checks.

Question 6

Which THREE of the following are examples of how network segmentation supports the principle of defense in depth?

Accepted Answer

It restricts lateral movement for an attacker who has compromised a device.. Network segmentation breaks a flat network into smaller, isolated subnets. This limits the blast radius of a breach by preventing lateral movement, restricting access to sensitive data, and providing points to inspect traffic between zones. By enforcing boundaries, the organization ensures that an attacker who compromises a workstation in one zone cannot easily pivot to critical servers in another, thus creating multiple functional barriers that the attacker must overcome to reach the high-value targets.

Answer

It eliminates the need for host-based firewalls on individual servers.

Answer

It automatically encrypts all data in transit between segments.

Question 7

Which concept describes the use of security controls that operate at the perimeter, network, host, application, and data layers to protect an organization?

Accepted Answer

Defense in Depth. This approach is the definition of defense in depth, which utilizes multiple layers of security across the entire IT stack. By distributing controls across these distinct layers, an organization ensures that there are multiple obstacles between an attacker and the sensitive data. This holistic coverage is essential because attackers often use multi-stage campaigns, and having defenses at every level allows for detection and interception at different phases of the attack lifecycle.

Answer

Zero Trust Architecture

Answer

Security Information and Event Management (SIEM)

Answer

Privileged Access Management (PAM)

Question 8

Why does the inclusion of detective controls improve a defense in depth strategy?

Accepted Answer

They provide visibility into successful bypasses of preventive controls.. Preventive controls are not always effective against every threat; therefore, detective controls are necessary to identify breaches that successfully penetrate the perimeter. By monitoring for indicators of compromise, security teams can respond to incidents in progress. This reduces the dwell time of an attacker, preventing a minor initial compromise from escalating into a major data exfiltration event. Detective controls effectively close the loop between prevention and response in a defense in depth model.

Answer

They automatically block all malicious traffic before it reaches the network.

Answer

They remove the need for regular vulnerability assessments.

Answer

They ensure that all user actions are strictly restricted by policy.

Question 9

A financial services firm has deployed a next-generation firewall at its internet perimeter, host-based firewalls on every workstation, and VLAN segmentation between departments. During a purple-team exercise, analysts discover that a contractor's laptop, once connected to the internal network, can reach the HR payroll server directly over SMB. The security team wants to enforce the principle of least privilege on this internal traffic. Which control should they implement to best achieve this?

Accepted Answer

Implement internal microsegmentation with host-based firewall rules that allow only authorized HR subnets to reach the payroll server on TCP 445.. The contractor's laptop is an internal host, so perimeter and network-based detective controls do not stop it from reaching the payroll server. Microsegmentation with host-based firewall rules enforces least privilege by permitting only the HR subnet to use SMB against that server. This limits lateral movement and adds a granular layer of defense that complements existing perimeter and segmentation controls.

Answer

Deploy an intrusion prevention system (IPS) on the internal network to block SMB exploits.

Answer

Enable port security on the access switch to limit the number of MAC addresses per port.

Answer

Configure the perimeter firewall to block all inbound SMB traffic from the internet.

Question 10

A healthcare provider is designing a defense in depth strategy for its electronic health record (EHR) system. The security architect proposes using a different vendor's endpoint detection and response (EDR) product, a different firewall brand, and a different SIEM platform than those used by the rest of the organization. The CIO asks why heterogeneous controls are preferred over standardizing on a single vendor. Which statement best justifies the architect's recommendation?

Accepted Answer

Using different vendors ensures that a single exploit or misconfiguration cannot simultaneously compromise all layers of defense.. Heterogeneous security controls create independent failure domains. If one vendor's product has a vulnerability or is misconfigured, the others are unlikely to share the same flaw, so a single exploit cannot disable all layers. This diversity strengthens defense in depth by preventing common-mode failures, which is the architect's core justification for mixing vendors in the EHR environment.

Answer

Heterogeneous controls reduce licensing costs because multiple vendors compete for the same functionality.

Answer

Different vendors provide more comprehensive log formats that are easier to correlate in the SIEM.

Answer

Heterogeneous controls are required by HIPAA for any system that stores electronic protected health information.

Question 11

A hospital's IT team is designing layered defenses for its electronic health record (EHR) system. They already have perimeter firewalls, network intrusion prevention, and endpoint antivirus. The CISO wants to add a control that detects unauthorized modification of EHR database records and alerts the security team in near real time. Which control best fills this gap while preserving defense in depth?

Accepted Answer

File integrity monitoring (FIM) with cryptographic hashing on the EHR database files. The scenario requires a detective control that specifically identifies unauthorized changes to EHR database records. File integrity monitoring with cryptographic hashing provides exactly that by comparing current file hashes to a trusted baseline and alerting on mismatch. The other options either duplicate existing preventive controls or provide logging without integrity detection, leaving the data-layer gap unaddressed.

Answer

Implementing full-disk encryption on the EHR database servers

Answer

Configuring syslog forwarding from the EHR servers to a central SIEM

Answer

Deploying an additional host-based firewall on the EHR application servers

Question 12

A hospital's billing server runs Windows Server 2019 and stores insurance claim data. The security team wants to add a control that will detect unauthorized modification of the claim files even if an attacker gains administrative access to the operating system. Which control best meets this requirement?

Accepted Answer

Implement file integrity monitoring (FIM) using SHA-256 hashes of the claim files and schedule regular baseline comparisons.. Detecting unauthorized modification of stored data requires a mechanism that can prove whether contents changed, regardless of the attacker's privilege level. Hash-based file integrity monitoring establishes a trusted baseline and alerts on any deviation, which is exactly what the hospital needs. Encryption and auditing address confidentiality and visibility respectively, and neither produces cryptographic evidence of tampering.

Answer

Configure Windows Audit Policy to log all file access events to the Security event log.

Answer

Enable Windows BitLocker full-disk encryption on the billing server's data volume.

Answer

Deploy a host-based intrusion prevention system (HIPS) that blocks suspicious process execution on the billing server.

Question 13

A small financial firm has a flat network with no internal segmentation. The security team wants to apply defense in depth to limit the blast radius of a compromised workstation. Which action best aligns with that goal?

Accepted Answer

Segmenting the network into VLANs based on function and applying ACLs between them. To limit the blast radius of a compromised workstation, the firm needs internal segmentation that restricts lateral movement. VLANs with inter-VLAN ACLs create logical boundaries so that a compromised host cannot freely access other segments. This is a classic defense-in-depth control that adds an internal layer beyond perimeter defenses. Authentication and WAF controls address different threats and do not contain an internal compromise.

Answer

Implementing 802.1X port-based network access control on all switch ports

Answer

Deploying a web application firewall (WAF) in front of the firm's public website

Answer

Enforcing strong password policies and multi-factor authentication for all users

Question 14

A financial services firm separates its cardholder data environment from the corporate network using internal VLANs and a next-generation firewall. The security architect wants to add a detective control that will identify malicious traffic that successfully crosses between segments. Which solution best fits this requirement?

Accepted Answer

Install a network intrusion detection system (NIDS) with a span port monitoring traffic between the VLANs.. The architect needs visibility into traffic that crosses the segmentation boundary, which is a detective control function. A network intrusion detection system monitoring a SPAN port sees copies of packets traversing the inter-VLAN link and can alert on malicious patterns. WAFs, 802.1X, and private VLANs either focus on web traffic or enforce preventive access restrictions, none of which detect successful cross-segment intrusions.

Answer

Configure private VLANs to prevent hosts within the cardholder data environment from communicating with each other.

Answer

Deploy a web application firewall (WAF) in front of the cardholder data environment.

Answer

Enable 802.1X port-based network access control on all switch ports in both VLANs.

Question 15

A retail company is reviewing its defense in depth strategy after a breach where an attacker used stolen credentials to access a database server. The investigation showed that the server had no host-based logging, and database activity was not monitored. Which TWO controls should be added to improve detection of similar future attacks? (Choose two.)

Accepted Answer

Deploying host-based intrusion detection system (HIDS) agents on database servers. The breach exploited stolen credentials to access a database server, and the gaps were lack of host-based logging and database activity monitoring. HIDS agents provide host-level visibility into attacker actions, while DAM logs and alerts on suspicious database queries. Together they create detective controls that would likely have identified the unauthorized access. The other options are preventive or confidentiality controls that do not address the detection gap.

Answer

Enforcing a password complexity policy for all database accounts

Answer

Implementing full-disk encryption on the database server

Answer

Configuring a next-generation firewall to block outbound traffic from the database server