GSEC macOS Security Practice Test 1 — 15 Questions

Question 1

A security analyst is investigating a macOS endpoint that appears to have an unauthorized kernel extension loaded. Which command-line utility should the analyst use to list currently loaded kernel extensions to verify if the extension is properly signed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kextstat. The 'kextstat' command lists all currently loaded kernel extensions (kexts) on macOS. By auditing these extensions, analysts can identify suspicious code running at the kernel level. This is a critical skill for GSEC professionals, as kernel-level persistence is a high-impact threat. Understanding how to interact with the kernel-loading subsystem allows security teams to verify the legitimacy of drivers and identify unauthorized or malicious software that has circumvented standard security controls.

Answer

sysctl -a

Answer

tmutil list

Answer

spctl --list

Question 2

Which security framework is primarily responsible for managing the 'App Sandbox' on macOS, preventing applications from accessing files outside their designated container?

Accepted Answer

Seatbelt. The App Sandbox is a mandatory access control feature that restricts applications to a specific container, preventing unauthorized access to system files, user data, and hardware peripherals. Understanding the App Sandbox is essential for GSEC, as it provides a critical layer of defense that mitigates the impact of potential vulnerabilities within applications, limiting the reach of an exploit to a confined, non-privileged environment.

Answer

FileVault

Answer

KextPolicy

Answer

TCC (Transparency, Consent, and Control)

Question 3

Which THREE of the following are examples of macOS TCC (Transparency, Consent, and Control) protection categories?

Accepted Answer

Contacts. TCC is the macOS security framework that requires user consent for an application to access sensitive data or peripherals. For GSEC professionals, mastering TCC is vital because it represents the primary user-facing barrier to data exfiltration and unauthorized peripheral usage. Understanding these categories is essential for auditing security profiles and troubleshooting why legitimate applications may be blocked from accessing required system resources in a corporate environment.

Answer

Kernel Extensions

Answer

System Integrity Protection

Question 4

A security analyst is reviewing a macOS Ventura endpoint and needs to determine whether Full Disk Access has been granted to a third-party backup agent. The analyst has Terminal access but wants to avoid changing any system state. Which command should the analyst run to inspect the TCC database entry for the backup agent?

Accepted Answer

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client, auth_value FROM access WHERE service='kTCCServiceSystemPolicyAllFiles';". Full Disk Access on macOS is recorded in the system-level TCC database at /Library/Application Support/com.apple.TCC/TCC.db as the service kTCCServiceSystemPolicyAllFiles. Reading it with sqlite3 in a SELECT-only manner satisfies the no-modification requirement while revealing the client bundle identifier and its auth_value. The other choices either target the wrong storage format, perform a destructive reset, or inspect unrelated application metadata.

Answer

tccutil reset AllFiles com.example.backupagent

Answer

system_profiler SPApplicationsDataType | grep -i backup

Answer

defaults read /Library/Preferences/com.apple.TCC.plist kTCCServiceSystemPolicyAllFiles

Question 5

A Mac administrator wants to ensure that only Apple-signed and notarized software can execute on managed endpoints, blocking any unsigned binaries even when downloaded from the internet. Which macOS configuration most directly enforces this requirement?

Accepted Answer

Deploy a configuration profile that sets the system policy to require notarization for all software via the com.apple.systempolicy.control payload.. Gatekeeper behavior is configurable through the com.apple.systempolicy.control configuration payload. Setting the policy to require notarization ensures that only software signed by a valid Developer ID and notarized by Apple can launch, blocking unsigned binaries. The other options either address unrelated protections such as memory entitlements or encryption-at-rest, or they weaken Gatekeeper by clearing the quarantine flag.

Answer

Set the quarantine attribute to 0 on all downloaded files using a script so that Gatekeeper evaluates every binary.

Answer

Enable FileVault on all endpoints so that unsigned binaries cannot be decrypted and executed.

Answer

Set the com.apple.security.cs.allow-unsigned-executable-memory entitlement to false via a configuration profile.

Question 6

A security administrator is reviewing a macOS Ventura endpoint and wants to confirm which security policies are currently enforced by the Secure Enclave. Which command-line utility should be used to display the current security configuration, including Secure Enclave status?

Accepted Answer

bputil -d. On Apple silicon Macs, security policies are managed by the Secure Enclave and can be inspected using the bputil command. Running bputil -d shows the current Secure Boot policy, kernel extension policy, and other security-related settings. The other commands focus on software-level protections like SIP or Gatekeeper, which do not reflect the hardware-backed enforcement provided by the Secure Enclave.

Answer

csrutil status

Answer

system_profiler SPiBridgeDataType

Answer

spctl --status

Question 7

A security engineer is hardening a fleet of Mac computers running macOS Ventura. The engineer wants to ensure that only trusted kernel extensions can load. Which command should be used to check the current kernel extension policy on an Apple silicon Mac?

Accepted Answer

bputil -d. On Apple silicon Macs, the kernel extension policy is part of the security configuration managed by the Secure Enclave. The bputil -d command displays this policy, showing whether the system allows only Apple-signed kernel extensions or also permits user-approved ones from identified developers. This is essential for hardening because it ensures that only trusted code runs in kernel space. Other commands either list loaded extensions or check different security features.

Answer

spctl --status

Answer

kextstat

Answer

systemextensionsctl list

Question 8

A security team is tuning endpoint detection on macOS and wants to monitor authentication events, including failed sudo attempts and login failures, in a centralized log pipeline. The team plans to stream relevant events from the unified logging system. Which command should the team use to capture authentication-related log entries in real time?

Accepted Answer

log stream --predicate 'process == "sudo" OR process == "loginwindow" OR process == "authd"' --level info. macOS records authentication events in the unified logging system, and the log stream command provides a live feed. Predicating on the processes that emit authentication activity, such as sudo, loginwindow, and authd, isolates failed sudo attempts and login failures. This streamed output can be piped into a central collector, satisfying the team's requirement for real-time authentication telemetry.

Answer

syslog -w -k 'Facility eq auth'

Answer

log show --last 1h --predicate 'eventMessage CONTAINS "auth"'

Answer

log stream --predicate 'subsystem == "com.apple.securityd"' --level debug

Question 9

A security analyst is examining a macOS Ventura endpoint that is suspected of having a malicious background service. The analyst runs `launchctl print system/com.apple.securityd` and sees the service is loaded, but when checking `/System/Library/LaunchDaemons/com.apple.securityd.plist`, the file is present. However, the analyst also notices a suspicious `com.apple.securityd.plist` file in `/Library/LaunchDaemons/`. Which of the following best describes the security implication and the correct action?

Accepted Answer

The file in `/Library/LaunchDaemons/` is likely a malicious persistence mechanism because it can load a service with the same label as a system service, and the analyst should inspect its contents and remove it if unauthorized.. A duplicate launch daemon plist in `/Library/LaunchDaemons/` can be used for persistence by mimicking a system service. Because launchd loads daemons from multiple directories, an attacker can place a malicious plist with the same label as a legitimate one, potentially causing the malicious version to execute. The analyst should inspect the file's contents, check its code signature or hash, and remove it if unauthorized.

Answer

The presence of the file in `/Library/LaunchDaemons/` indicates that System Integrity Protection (SIP) has been disabled, because SIP prevents any modifications to launchd directories.

Answer

The file in `/Library/LaunchDaemons/` is harmless because launchd only loads plists from `/System/Library/LaunchDaemons/` and ignores other directories unless explicitly enabled.

Answer

The file in `/Library/LaunchDaemons/` is a legitimate override and can be safely ignored because macOS prioritizes files in `/System/Library/LaunchDaemons/`.

Question 10

An organization requires that all employee MacBook Pro devices prevent unauthorized modifications to the system kernel. Which macOS security feature should the administrator focus on to ensure that only Apple-signed code executes at the kernel level?

Accepted Answer

System Integrity Protection (SIP). System Integrity Protection (SIP) is the macOS feature designed to restrict the root user from performing actions that could compromise system integrity. By enforcing kernel-level protection, SIP prevents malicious code from injecting into system processes or modifying protected files. Understanding SIP is critical for GSEC candidates as it represents the foundational boundary between user-space applications and sensitive kernel operations, serving as a primary defense against rootkits and low-level system tampering.

Answer

FileVault 2

Answer

Gatekeeper

Answer

XProtect

Question 11

Which TWO of the following actions are primarily restricted by macOS System Integrity Protection (SIP)?

Accepted Answer

Modifying files within the /System directory. SIP is a crucial security layer that limits root user capabilities to prevent system-level damage. By restricting modifications to protected system directories and kernel extensions, it effectively hardens the operating system against exploitation. For GSEC professionals, identifying what SIP protects is vital for performing system audits, troubleshooting software installations, and managing secure configurations, as these restrictions often impact how security agents and administrative tools interact with the underlying OS.

Answer

Installing unsigned applications from the internet

Answer

Accessing user-defined keychain items

Answer

Encrypting the user home directory

Question 12

Refer to the exhibit. An administrator runs the provided command on a macOS device to verify the security configuration. Given the output, what is the most appropriate interpretation regarding the security posture of this endpoint?

Accepted Answer

The endpoint's kernel integrity protections are actively enforced.. The output confirms that System Integrity Protection is currently active on the host. This status indicates that the core OS protections are enforced, preventing unauthorized modification of system-protected locations and restricted kernel operations. In a GSEC context, confirming the status of SIP is a primary validation step during an incident response or security audit, as disabling SIP is a common technique used by attackers to gain persistence and evade detection on macOS.

Answer

The endpoint is vulnerable to root-level system file modification.

Answer

The disk encryption configuration is currently failing.

Answer

The device has been successfully compromised by a kernel rootkit.

Question 13

A user reports they cannot open a downloaded application because macOS states the developer cannot be verified. Which security feature is preventing the execution of this application?

Accepted Answer

Gatekeeper. Gatekeeper is the security technology that verifies that software is from a trusted developer and has not been tampered with. By requiring code signing and notarization, Gatekeeper helps prevent the execution of malicious software. For a GSEC professional, recognizing Gatekeeper's role is key to troubleshooting deployment issues while maintaining the organization's security policy, as it is the first line of defense against unauthorized applications running on the user's desktop.

Answer

XProtect

Answer

System Integrity Protection

Answer

FileVault 2

Question 14

What is the primary purpose of the 'Notarization' process for macOS applications?

Accepted Answer

To scan for malicious code and verify developer identity.. Notarization is an automated system that scans software for malicious content and verifies that it is signed by a registered developer. It provides a level of assurance to users that the software has been reviewed by Apple. For GSEC, understanding notarization is crucial because it bridges the gap between basic code signing and runtime execution, ensuring that even signed software meets baseline security standards before deployment.

Answer

To provide full-disk encryption for the application data.

Answer

To restrict application access to user contact data.

Answer

To enforce system-level integrity of the kernel.

Question 15

A user attempts to launch a newly installed application on a macOS Monterey system, but the application fails to open with a message that it cannot be verified. The user is certain the application was downloaded from the developer's official website. Which macOS feature is responsible for this behavior?

Accepted Answer

Gatekeeper. Gatekeeper is designed to ensure that only trusted software runs on macOS. When an application is downloaded from the internet, Gatekeeper checks its code signature and notarization status. If the app is not signed with a valid Developer ID or not notarized, Gatekeeper blocks it and displays a warning. This matches the user's experience. The other features address different security aspects and would not produce this specific message.

Answer

XProtect

Answer

System Integrity Protection (SIP)

Answer

Transparency, Consent, and Control (TCC)