GSEC Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Accepted Answer

It maps Security Identifiers (SIDs) to user profile directories.. The ProfileList key maps SIDs to user profile paths. This is critical because an attacker may create a temporary or hidden account. By identifying the exact path to the user profile, the investigator knows where to look for user-specific artifacts like NTUSER.DAT, browser history, and temporary files. This mapping is the starting point for scoping user-level malicious activities and ensuring that no hidden accounts are overlooked during the investigation.

Answer

It defines the system's default language settings.

Answer

It logs every application the user has executed.

Answer

It lists all installed software on the system.

Question 2

A company stores backup tapes offsite. An auditor notes that the tapes contain sensitive customer data and are transported by a third-party courier. The security manager wants to ensure that a lost tape cannot expose customer information. Which control best addresses this risk?

Accepted Answer

Encrypt the backup tapes using AES-256 with keys managed separately from the tapes.. The risk is that a lost or stolen tape exposes customer data, so the control must make the data unreadable without authorization. Encrypting tapes with AES-256 and storing keys separately achieves this directly. NDAs, GPS tracking, and shorter retention periods address accountability, recovery, or exposure windows but leave the tape contents readable if the media falls into the wrong hands.

Answer

Require the courier to sign a non-disclosure agreement and provide chain-of-custody documentation.

Answer

Install GPS trackers on the transport vehicle and monitor the route in real time.

Answer

Reduce the backup retention period from one year to thirty days to limit exposure.

Question 3

A financial institution is implementing a new access control system for its trading floor. The security team must enforce a model that supports dynamic, fine-grained access decisions based on user attributes, resource attributes, and environmental conditions such as time of day. The system must also allow for centralized policy management and auditing. Which TWO of the following access control models best fit these requirements? (Choose two.)

Accepted Answer

Policy-Based Access Control (PBAC). Attribute-Based Access Control and Policy-Based Access Control both support dynamic, fine-grained access decisions using attributes and environmental conditions. They allow centralized policy management and auditing, which are critical for the financial institution. RBAC, MAC, and DAC lack the necessary flexibility and context-awareness. Therefore, ABAC and PBAC are the correct choices.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 4

After a major security breach, the incident response team conducts a lessons-learned meeting. The team identifies that the initial detection was delayed because log sources were not properly integrated into the SIEM. Which phase of the incident response lifecycle does this finding primarily aim to improve?

Accepted Answer

Preparation. The finding that log sources were not integrated into the SIEM points to a gap in preparation. Preparation involves setting up logging, monitoring, and detection tools. By addressing this, the team enhances future detection capabilities. While the review occurs in Post-Incident Activity, the corrective action targets Preparation.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 5

A security analyst is reviewing a web application's HTTP response headers and notices the following header: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'. The analyst is concerned about the application's resilience to cross-site scripting (XSS). Which of the following best describes the security implication of this policy?

Accepted Answer

The policy is insecure because it allows inline scripts, which can be exploited by XSS attacks.. The Content-Security-Policy header includes 'unsafe-inline' in the script-src directive, which permits inline JavaScript execution. This directly undermines CSP's ability to prevent XSS attacks, as injected inline scripts will run. The correct answer identifies that allowing inline scripts makes the policy insecure. The other options incorrectly focus on external script restrictions or reporting, missing the critical weakness.

Answer

The policy is insecure because it lacks a report-uri directive, so violations cannot be monitored.

Answer

The policy is secure because default-src 'self' prevents loading scripts from external domains, mitigating XSS.

Answer

The policy is secure because it restricts scripts to the same origin and disallows inline scripts.

Question 6

A healthcare provider is designing a defense in depth strategy for its electronic health record (EHR) system. The security architect proposes using a different vendor's endpoint detection and response (EDR) product, a different firewall brand, and a different SIEM platform than those used by the rest of the organization. The CIO asks why heterogeneous controls are preferred over standardizing on a single vendor. Which statement best justifies the architect's recommendation?

Accepted Answer

Using different vendors ensures that a single exploit or misconfiguration cannot simultaneously compromise all layers of defense.. Heterogeneous security controls create independent failure domains. If one vendor's product has a vulnerability or is misconfigured, the others are unlikely to share the same flaw, so a single exploit cannot disable all layers. This diversity strengthens defense in depth by preventing common-mode failures, which is the architect's core justification for mixing vendors in the EHR environment.

Answer

Heterogeneous controls reduce licensing costs because multiple vendors compete for the same functionality.

Answer

Different vendors provide more comprehensive log formats that are easier to correlate in the SIEM.

Answer

Heterogeneous controls are required by HIPAA for any system that stores electronic protected health information.

Question 7

A security team is configuring an authenticated vulnerability scan of a Linux server farm using SSH. The scanner reports that it cannot log in to several hosts even though the same credentials work manually. Which configuration change is MOST likely to resolve the issue?

Accepted Answer

Allow the scanner's public key in the authorized_keys file for the scan account. Authenticated SSH scans rely on the scanner presenting a key that the target accepts. When manual logins work but the scanner fails, the usual cause is that the scanner's public key has not been installed in the scan account's authorized_keys file. Adding that key restores authentication without weakening the host's security posture, unlike enabling password authentication or disabling SELinux.

Answer

Enable password authentication on the target hosts

Answer

Change the SSH port on the targets to 2222

Answer

Disable SELinux on the target hosts

Question 8

To ensure a Linux server is protected against unauthorized physical access or boot-level modifications, which THREE security controls should be implemented?

Accepted Answer

Setting a BIOS/UEFI password. Boot security is often overlooked but is a critical component of overall system hardening. If an attacker has physical access and the boot process is not secured, they can easily bypass operating system security controls by booting into single-user mode or using a live environment to mount and modify the local filesystem.

Answer

Enabling the sticky bit on /tmp

Answer

Disabling the IPv6 network stack

Question 9

A GSEC consultant is hardening a Kubernetes cluster that runs multi-tenant workloads. A developer reports that a pod in the tenants namespace was able to read the contents of the kubelet's host filesystem at /var/lib/kubelet. The pod spec includes hostPath: {path: /var/lib/kubelet, type: Directory} under volumes and mounts it at /host. The cluster has Pod Security Admission enabled with the restricted profile enforced cluster-wide, but the tenants namespace was labeled pod-security.kubernetes.io/enforce: privileged to unblock a legacy job. Which action most directly closes this exposure?

Accepted Answer

Remove the privileged label from the tenants namespace so the restricted profile is enforced there, and refactor the legacy job to run without a hostPath mount.. Pod Security Admission decides admission based on the namespace's pod-security.kubernetes.io/enforce label, and the privileged value on the tenants namespace overrode the cluster-wide restricted profile. That exemption is precisely what let a pod mount the node's /var/lib/kubelet directory via hostPath. Removing the label restores restricted enforcement, which forbids hostPath volumes, and refactoring the legacy job removes the need for the exemption so the exposure cannot be recreated.

Answer

Enable the NodeRestriction admission plugin and rotate the kubelet client certificates on all worker nodes.

Answer

Add a seccomp profile of RuntimeDefault to the pod and set allowPrivilegeEscalation to false in its securityContext.

Answer

Create an OPA Gatekeeper constraint that denies pods whose namespaces carry the privileged enforcement label.

Question 10

A SIEM administrator is troubleshooting why Windows event logs forwarded from a domain controller are not being parsed correctly. The logs are sent using the Windows Event Forwarding (WEF) subscription, but the SIEM shows raw XML instead of normalized fields. The administrator confirms that the WEF subscription is active and events are arriving. Which action should the administrator take to ensure proper parsing?

Accepted Answer

Create a custom parser in the SIEM that extracts fields from the XML structure of the WEF events.. WEF forwards events in XML format. If the SIEM's collector is not configured to parse that XML, it stores raw XML and fields are not normalized. The administrator should create a custom parser that extracts relevant fields from the WEF XML schema and maps them to the SIEM's data model. Other options either do not address the parsing issue or are technically infeasible.

Answer

Install a SIEM agent on the domain controller to read the event logs directly and forward them in a normalized format.

Answer

Configure the SIEM to use the Windows Event Log collector with the correct channel names and enable XML parsing.

Answer

Modify the WEF subscription to forward events in JSON format instead of XML.

Question 11

A security analyst is investigating a suspected credential theft attack on a Windows 10 workstation. The analyst reviews the Security event log and sees Event ID 4648 (A logon was attempted using explicit credentials) occurring repeatedly for a service account. Which of the following best describes the significance of this event in the context of credential theft?

Accepted Answer

It indicates that the service account's credentials were used to run a process with explicit credentials, which could be a sign of pass-the-hash or credential reuse.. Event ID 4648 is generated when a logon is attempted using explicit credentials, such as with RunAs or a scheduled task. In credential theft, attackers may use stolen credentials to start processes, causing this event. Repeated occurrences for a service account can signal malicious activity. Other events like 4625, 4740, or 4672 have different meanings and are not directly indicative of explicit credential use.

Answer

It indicates that the service account was granted special privileges, such as SeDebugPrivilege, which is a common post-exploitation step.

Answer

It indicates that the service account's password was changed, which is a common persistence technique after credential theft.

Answer

It indicates that the service account was locked out due to multiple failed logon attempts, which is a sign of brute-force attack.

Question 12

Which TWO of the following statements accurately describe the characteristics of UDP compared to TCP?

Accepted Answer

UDP is faster due to the lack of a handshake.. UDP is a connectionless, datagram-oriented protocol that prioritizes speed and efficiency over reliability. It does not perform handshakes, flow control, or error correction, making it ideal for real-time applications like VoIP. TCP, conversely, provides a reliable stream by managing connections and acknowledging packet delivery. Understanding these differences is crucial for firewall configuration, as security policies must account for the stateless nature of UDP versus the stateful requirements of TCP.

Answer

UDP provides guaranteed delivery of packets.

Answer

UDP uses flow control to manage data transmission rates.

Answer

UDP is the primary protocol for HTTP web traffic.

Question 13

An incident responder notices suspicious memory usage on a protected host. Which endpoint forensic technique is most reliable for detecting file-less malware that resides only in RAM?

Accepted Answer

Performing a memory dump and analyzing it for anomalous process threads.. File-less malware operates by injecting malicious code directly into the memory space of legitimate system processes. Traditional disk-based scanning tools will miss this, as no malicious file exists on the filesystem. Detecting file-less attacks requires inspecting memory for anomalies, such as injected threads or hooked functions, which requires specialized tools capable of analyzing process memory structures in real-time.

Answer

Scanning the hard drive for known malicious file signatures.

Answer

Analyzing the Master File Table (MFT) for deleted entries.

Answer

Checking the Windows Event Logs for failed login attempts.

Question 14

A security engineer is designing a password hashing scheme for a new application. The scheme must be resistant to GPU-accelerated cracking and allow for tuning of CPU and memory costs. Which hashing algorithm should the engineer choose?

Accepted Answer

Argon2. Argon2 is specifically designed to be memory-hard and CPU-hard, with tunable parameters for time, memory, and parallelism. This makes it resistant to GPU-accelerated cracking and allows customization for different environments. bcrypt and PBKDF2 lack memory tuning, and SHA-256 is too fast. Therefore, Argon2 is the correct choice for the password hashing scheme.

Answer

PBKDF2

Answer

bcrypt

Answer

SHA-256 with a random salt

Question 15

A security analyst is examining a web application that uses JSON Web Tokens (JWT) for authentication. The analyst captures a token and notices that the header contains "alg": "none". The analyst is concerned about the security of the application. Which of the following best describes the risk associated with this token?

Accepted Answer

The token is unsigned, allowing an attacker to modify the payload and forge valid tokens.. A JWT with "alg": "none" is unsigned, meaning it has no integrity protection. An attacker can tamper with the payload and, if the server accepts such tokens, forge arbitrary claims. This can lead to authentication bypass or privilege escalation. The correct answer identifies that the token is unsigned and can be modified. The other options mischaracterize the token as encrypted, weakly signed, or solely vulnerable to replay, missing the core issue of missing signature verification.

Answer

The token uses a weak signing algorithm that can be brute-forced to recover the secret key.

Answer

The token is vulnerable to replay attacks because it lacks an expiration claim.

Answer

The token is encrypted, so the contents cannot be read by an attacker.

Question 16

A security engineer is designing a secure enterprise environment and needs to deploy network intrusion detection sensors to monitor east-west traffic moving between virtual machines inside an internal virtualization cluster. Which deployment method ensures the sensors successfully inspect internal segment traffic without introducing a single point of failure for packet forwarding?

Accepted Answer

Configuring hypervisor-level distributed virtual switches to mirror east-west traffic to dedicated virtual security monitoring appliances.. Using virtual tap interfaces or distributed software switches configured for port mirroring allows security sensors to receive copies of internal traffic traversing the hypervisor backplane. This approach ensures comprehensive visibility into east-west lateral movement without altering inline packet forwarding paths, maintaining network availability while delivering the necessary telemetry for threat detection engines.

Answer

Placing a dedicated physical inline bump-in-the-wire network intrusion prevention system between every internal virtual switch uplink.

Answer

Routing all inter-VLAN traffic through a single legacy perimeter firewall using hardware router-on-a-stick configurations.

Answer

Disabling all stateful packet inspection on internal firewalls to allow maximum throughput for east-west virtualization traffic.

Question 17

An administrator is configuring NTFS permissions on a folder named C:\Audit. The folder currently has inheritance enabled from C:\, which grants Users Read & Execute. The administrator wants to prevent members of the group Temp_Contractors from accessing the folder, but they must still be able to access other folders on the C: drive. The administrator adds an explicit Deny Full Control permission for Temp_Contractors on C:\Audit. What is the effect of this change?

Accepted Answer

Members of Temp_Contractors will be denied access to C:\Audit, but will retain their inherited permissions on other folders.. Explicit Deny permissions override inherited Allow permissions. Placing a Deny Full Control for Temp_Contractors on C:\Audit blocks their access to that folder and its subfolders (if inheritance is enabled), but does not affect other folders on the C: drive. Therefore, the correct outcome is that Temp_Contractors are denied access to C:\Audit while retaining access to other folders.

Answer

Members of Temp_Contractors will be denied access to the entire C: drive because Deny permissions propagate upward.

Answer

The Deny permission will be ignored because inherited Allow permissions take precedence over explicit Deny permissions.

Answer

Members of Temp_Contractors will still have access to C:\Audit because they are also members of the Users group, which has inherited Allow permissions.

Question 18

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

Accepted Answer

Get-LocalGroupMember -Group Administrators. Effective auditing requires querying local identity stores and task schedules. 'Get-LocalGroupMember' provides a snapshot of accounts with elevated or specific access, while 'Get-ScheduledTask' identifies persistent malicious mechanisms. Understanding these commands is critical for GSEC professionals to perform rapid host-based forensics, as these two areas are frequent targets for persistence and lateral movement by attackers.

Answer

Get-Process -IncludeUserName

Answer

Get-Service | Where-Object {$_.Status -eq 'Running'}

Answer

Get-WinEvent -LogName Security

Question 19

A software company is hardening its Linux build pipeline. The team wants to apply defense in depth controls that reduce the impact of a compromised build server. Which THREE actions best support this goal? (Choose three.)

Accepted Answer

Require all build servers to authenticate users with individual SSH keys and disable password authentication.. Reducing the impact of a compromised build server requires layered constraints: container isolation with dropped capabilities and read-only filesystems limits what code can do, HSM-backed signing keys with dual authorization protect the supply chain, and per-user SSH keys harden initial access. Disabling SELinux and granting unrestricted sudo both expand attacker privileges, so they weaken rather than strengthen the layered defense.

Answer

Grant the build service account passwordless sudo access to all commands to simplify automation.

Answer

Disable SELinux on the build server to avoid build failures caused by mandatory access control denials.

Question 20

Refer to the exhibit. An administrator runs this command to generate a certificate signing request. Which security vulnerability is introduced by the inclusion of the -nodes flag in this command?

Accepted Answer

The private key will be stored without passphrase protection. The -nodes flag instructs OpenSSL to generate a private key without a passphrase, leaving it stored in plaintext on the file system. In a production environment, this is critical because an attacker with unauthorized read access to the server's filesystem can immediately compromise the private key. Protecting private keys with a passphrase ensures that even if files are exfiltrated, the keys remain encrypted and unusable without the secret passphrase.

Answer

The RSA key length is insufficient for modern requirements

Answer

The certificate will be self-signed and untrusted

Answer

The output file format defaults to a deprecated encoding