GSEC macOS Security — 10 Questions

Question 1

A security analyst is investigating a macOS endpoint that appears to have an unauthorized kernel extension loaded. Which command-line utility should the analyst use to list currently loaded kernel extensions to verify if the extension is properly signed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kextstat. The 'kextstat' command lists all currently loaded kernel extensions (kexts) on macOS. By auditing these extensions, analysts can identify suspicious code running at the kernel level. This is a critical skill for GSEC professionals, as kernel-level persistence is a high-impact threat. Understanding how to interact with the kernel-loading subsystem allows security teams to verify the legitimacy of drivers and identify unauthorized or malicious software that has circumvented standard security controls.

Answer

sysctl -a

Answer

tmutil list

Answer

spctl --list

Question 2

Which security framework is primarily responsible for managing the 'App Sandbox' on macOS, preventing applications from accessing files outside their designated container?

Accepted Answer

Seatbelt. The App Sandbox is a mandatory access control feature that restricts applications to a specific container, preventing unauthorized access to system files, user data, and hardware peripherals. Understanding the App Sandbox is essential for GSEC, as it provides a critical layer of defense that mitigates the impact of potential vulnerabilities within applications, limiting the reach of an exploit to a confined, non-privileged environment.

Answer

FileVault

Answer

KextPolicy

Answer

TCC (Transparency, Consent, and Control)

Question 3

Which THREE of the following are examples of macOS TCC (Transparency, Consent, and Control) protection categories?

Accepted Answer

Contacts. TCC is the macOS security framework that requires user consent for an application to access sensitive data or peripherals. For GSEC professionals, mastering TCC is vital because it represents the primary user-facing barrier to data exfiltration and unauthorized peripheral usage. Understanding these categories is essential for auditing security profiles and troubleshooting why legitimate applications may be blocked from accessing required system resources in a corporate environment.

Answer

Kernel Extensions

Answer

System Integrity Protection

Question 4

A security analyst is reviewing a macOS Ventura endpoint and needs to determine whether Full Disk Access has been granted to a third-party backup agent. The analyst has Terminal access but wants to avoid changing any system state. Which command should the analyst run to inspect the TCC database entry for the backup agent?

Accepted Answer

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client, auth_value FROM access WHERE service='kTCCServiceSystemPolicyAllFiles';". Full Disk Access on macOS is recorded in the system-level TCC database at /Library/Application Support/com.apple.TCC/TCC.db as the service kTCCServiceSystemPolicyAllFiles. Reading it with sqlite3 in a SELECT-only manner satisfies the no-modification requirement while revealing the client bundle identifier and its auth_value. The other choices either target the wrong storage format, perform a destructive reset, or inspect unrelated application metadata.

Answer

tccutil reset AllFiles com.example.backupagent

Answer

system_profiler SPApplicationsDataType | grep -i backup

Answer

defaults read /Library/Preferences/com.apple.TCC.plist kTCCServiceSystemPolicyAllFiles

Question 5

A Mac administrator wants to ensure that only Apple-signed and notarized software can execute on managed endpoints, blocking any unsigned binaries even when downloaded from the internet. Which macOS configuration most directly enforces this requirement?

Accepted Answer

Deploy a configuration profile that sets the system policy to require notarization for all software via the com.apple.systempolicy.control payload.. Gatekeeper behavior is configurable through the com.apple.systempolicy.control configuration payload. Setting the policy to require notarization ensures that only software signed by a valid Developer ID and notarized by Apple can launch, blocking unsigned binaries. The other options either address unrelated protections such as memory entitlements or encryption-at-rest, or they weaken Gatekeeper by clearing the quarantine flag.

Answer

Set the quarantine attribute to 0 on all downloaded files using a script so that Gatekeeper evaluates every binary.

Answer

Enable FileVault on all endpoints so that unsigned binaries cannot be decrypted and executed.

Answer

Set the com.apple.security.cs.allow-unsigned-executable-memory entitlement to false via a configuration profile.

Question 6

A security administrator is reviewing a macOS Ventura endpoint and wants to confirm which security policies are currently enforced by the Secure Enclave. Which command-line utility should be used to display the current security configuration, including Secure Enclave status?

Accepted Answer

bputil -d. On Apple silicon Macs, security policies are managed by the Secure Enclave and can be inspected using the bputil command. Running bputil -d shows the current Secure Boot policy, kernel extension policy, and other security-related settings. The other commands focus on software-level protections like SIP or Gatekeeper, which do not reflect the hardware-backed enforcement provided by the Secure Enclave.

Answer

csrutil status

Answer

system_profiler SPiBridgeDataType

Answer

spctl --status

Question 7

A security engineer is hardening a fleet of Mac computers running macOS Ventura. The engineer wants to ensure that only trusted kernel extensions can load. Which command should be used to check the current kernel extension policy on an Apple silicon Mac?

Accepted Answer

bputil -d. On Apple silicon Macs, the kernel extension policy is part of the security configuration managed by the Secure Enclave. The bputil -d command displays this policy, showing whether the system allows only Apple-signed kernel extensions or also permits user-approved ones from identified developers. This is essential for hardening because it ensures that only trusted code runs in kernel space. Other commands either list loaded extensions or check different security features.

Answer

spctl --status

Answer

kextstat

Answer

systemextensionsctl list

Question 8

A security team is tuning endpoint detection on macOS and wants to monitor authentication events, including failed sudo attempts and login failures, in a centralized log pipeline. The team plans to stream relevant events from the unified logging system. Which command should the team use to capture authentication-related log entries in real time?

Accepted Answer

log stream --predicate 'process == "sudo" OR process == "loginwindow" OR process == "authd"' --level info. macOS records authentication events in the unified logging system, and the log stream command provides a live feed. Predicating on the processes that emit authentication activity, such as sudo, loginwindow, and authd, isolates failed sudo attempts and login failures. This streamed output can be piped into a central collector, satisfying the team's requirement for real-time authentication telemetry.

Answer

syslog -w -k 'Facility eq auth'

Answer

log show --last 1h --predicate 'eventMessage CONTAINS "auth"'

Answer

log stream --predicate 'subsystem == "com.apple.securityd"' --level debug

Question 9

A security analyst is examining a macOS Ventura endpoint that is suspected of having a malicious background service. The analyst runs `launchctl print system/com.apple.securityd` and sees the service is loaded, but when checking `/System/Library/LaunchDaemons/com.apple.securityd.plist`, the file is present. However, the analyst also notices a suspicious `com.apple.securityd.plist` file in `/Library/LaunchDaemons/`. Which of the following best describes the security implication and the correct action?

Accepted Answer

The file in `/Library/LaunchDaemons/` is likely a malicious persistence mechanism because it can load a service with the same label as a system service, and the analyst should inspect its contents and remove it if unauthorized.. A duplicate launch daemon plist in `/Library/LaunchDaemons/` can be used for persistence by mimicking a system service. Because launchd loads daemons from multiple directories, an attacker can place a malicious plist with the same label as a legitimate one, potentially causing the malicious version to execute. The analyst should inspect the file's contents, check its code signature or hash, and remove it if unauthorized.

Answer

The presence of the file in `/Library/LaunchDaemons/` indicates that System Integrity Protection (SIP) has been disabled, because SIP prevents any modifications to launchd directories.

Answer

The file in `/Library/LaunchDaemons/` is harmless because launchd only loads plists from `/System/Library/LaunchDaemons/` and ignores other directories unless explicitly enabled.

Answer

The file in `/Library/LaunchDaemons/` is a legitimate override and can be safely ignored because macOS prioritizes files in `/System/Library/LaunchDaemons/`.

Question 10

An organization requires that all employee MacBook Pro devices prevent unauthorized modifications to the system kernel. Which macOS security feature should the administrator focus on to ensure that only Apple-signed code executes at the kernel level?

Accepted Answer

System Integrity Protection (SIP). System Integrity Protection (SIP) is the macOS feature designed to restrict the root user from performing actions that could compromise system integrity. By enforcing kernel-level protection, SIP prevents malicious code from injecting into system processes or modifying protected files. Understanding SIP is critical for GSEC candidates as it represents the foundational boundary between user-space applications and sensitive kernel operations, serving as a primary defense against rootkits and low-level system tampering.

Answer

FileVault 2

Answer

Gatekeeper

Answer

XProtect