GSEC Multiple Select — 30 Questions

Question 1

A financial institution is implementing a new access control system for its trading floor. The security team must enforce a model that supports dynamic, fine-grained access decisions based on user attributes, resource attributes, and environmental conditions such as time of day. The system must also allow for centralized policy management and auditing. Which TWO of the following access control models best fit these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy-Based Access Control (PBAC). Attribute-Based Access Control and Policy-Based Access Control both support dynamic, fine-grained access decisions using attributes and environmental conditions. They allow centralized policy management and auditing, which are critical for the financial institution. RBAC, MAC, and DAC lack the necessary flexibility and context-awareness. Therefore, ABAC and PBAC are the correct choices.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 2

A retail company is deploying a large language model (LLM) based customer support assistant that has access to internal order databases through a tool-calling interface. The security team wants to reduce the risk of sensitive data being exposed through the model's responses. Which two controls best address this risk? (Choose two.)

Accepted Answer

Enforce least-privilege access on the tool-calling interface so the model can retrieve only the fields needed for the current request.. Reducing sensitive data exposure in an LLM assistant requires controlling both what data the model can access and what it can emit. Least-privilege tool access limits the sensitive fields available to the model, while output filtering catches and redacts sensitive patterns before the user sees them. Together they provide defense in depth; the other options affect randomness, model artifact storage, or training, none of which govern runtime data flow.

Answer

Increase the model's temperature setting to make responses less predictable.

Answer

Store the model weights in a versioned object storage bucket with access logging enabled.

Answer

Fine-tune the model on a dataset of historical customer interactions.

Question 3

To ensure a Linux server is protected against unauthorized physical access or boot-level modifications, which THREE security controls should be implemented?

Accepted Answer

Setting a BIOS/UEFI password. Boot security is often overlooked but is a critical component of overall system hardening. If an attacker has physical access and the boot process is not secured, they can easily bypass operating system security controls by booting into single-user mode or using a live environment to mount and modify the local filesystem.

Answer

Enabling the sticky bit on /tmp

Answer

Disabling the IPv6 network stack

Question 4

Which TWO of the following PowerShell commands would you use to audit current local group membership and verify existing scheduled tasks on a compromised Windows server?

Accepted Answer

Get-LocalGroupMember -Group Administrators. Effective auditing requires querying local identity stores and task schedules. 'Get-LocalGroupMember' provides a snapshot of accounts with elevated or specific access, while 'Get-ScheduledTask' identifies persistent malicious mechanisms. Understanding these commands is critical for GSEC professionals to perform rapid host-based forensics, as these two areas are frequent targets for persistence and lateral movement by attackers.

Answer

Get-Process -IncludeUserName

Answer

Get-Service | Where-Object {$_.Status -eq 'Running'}

Answer

Get-WinEvent -LogName Security

Question 5

A software company is hardening its Linux build pipeline. The team wants to apply defense in depth controls that reduce the impact of a compromised build server. Which THREE actions best support this goal? (Choose three.)

Accepted Answer

Require all build servers to authenticate users with individual SSH keys and disable password authentication.. Reducing the impact of a compromised build server requires layered constraints: container isolation with dropped capabilities and read-only filesystems limits what code can do, HSM-backed signing keys with dual authorization protect the supply chain, and per-user SSH keys harden initial access. Disabling SELinux and granting unrestricted sudo both expand attacker privileges, so they weaken rather than strengthen the layered defense.

Answer

Grant the build service account passwordless sudo access to all commands to simplify automation.

Answer

Disable SELinux on the build server to avoid build failures caused by mandatory access control denials.

Question 6

A security team is implementing a SIEM and needs to ensure that log sources are properly normalized and enriched to support effective correlation and alerting. Which TWO of the following tasks are essential for achieving this goal? (Choose two.)

Accepted Answer

Enriching events with contextual data, such as asset criticality, user identity, and geolocation, from external sources.. Normalization and enrichment are critical for SIEM effectiveness. Mapping fields to a common schema like the Splunk CIM ensures consistent field names for correlation. Enriching with context such as asset criticality and geolocation improves alert accuracy and prioritization. These two tasks together enable the SIEM to correlate events across diverse sources and generate meaningful alerts.

Answer

Configuring the SIEM to drop logs that do not match the expected format to reduce noise.

Answer

Storing all raw logs indefinitely in their original format without normalization.

Answer

Increasing the SIEM's indexing speed by disabling timestamp recognition on all logs.

Question 7

A security engineer is hardening a Windows Server 2022 environment that hosts several critical services. The engineer wants to implement measures to protect against credential theft and privilege escalation via service accounts. Which two of the following actions should the engineer take? (Choose two.)

Accepted Answer

Implement a policy to regularly audit service accounts for excessive privileges and remove unnecessary rights, such as 'Act as part of the operating system' or 'Debug programs'.. The correct actions are to deploy gMSAs for domain-authenticated services and to audit and reduce service account privileges. gMSAs provide automatic password management and reduce credential theft risk. Auditing privileges ensures least privilege and removes dangerous rights. The other options either increase risk by granting excessive privileges or weaken security through reversible encryption or overly broad logon rights.

Answer

Assign the 'Log on as a service' right to all domain users to ensure that any service can start without interruption.

Answer

Configure all services to run under the Local System account to simplify management and ensure they have the necessary privileges.

Answer

Enable the 'Store passwords using reversible encryption' policy for all service accounts to allow easy recovery of passwords if needed.

Question 8

A security analyst is investigating a macOS Monterey system that may have been compromised. The analyst wants to check for signs of malicious kernel extensions. Which TWO of the following commands or tools are most appropriate for this task? (Choose two.)

Accepted Answer

kmutil showloaded. To check for malicious kernel extensions, an analyst should use tools that list loaded kexts. The kextstat command provides a list of loaded kernel extensions, while kmutil showloaded offers similar information with more detail. Both are appropriate for identifying unauthorized kexts. The other commands focus on system extensions, SIP status, or Gatekeeper assessments, which do not directly reveal loaded kernel extensions.

Answer

spctl --assess --verbose

Answer

systemextensionsctl list

Answer

csrutil status

Question 9

During an investigation, you discover a persistent backdoor. Which THREE actions should be included in the Eradication phase?

Accepted Answer

Resetting compromised user passwords. Eradication aims to completely remove the adversary's presence. Simply deleting a file is rarely sufficient; attackers often leave multiple persistence mechanisms or backdoors. By resetting credentials, patching the underlying vulnerability, and re-imaging systems, the organization ensures that the attacker cannot easily return, effectively closing the window of opportunity that allowed the initial unauthorized access to occur and persist.

Answer

Analyzing the memory dump for malware signatures

Answer

Drafting an incident report for executive leadership

Question 10

A security team is designing a resilient perimeter architecture to protect internal services from distributed denial of service attacks and web application exploits. Which THREE architectural components must be incorporated into this design? (Choose THREE)

Accepted Answer

A dedicated web application firewall to inspect HTTP and HTTPS traffic for application-layer vulnerabilities and injection attacks.. A robust perimeter defense requires multiple layers of inspection and mitigation. Web application firewalls inspect application-layer HTTP and HTTPS traffic to block injection attacks, hardware DDoS mitigation scrubbing centers absorb volumetric network floods upstream, and redundant boundary firewalls enforce stateful perimeter access control policies while eliminating single points of failure.

Answer

Unmanaged Layer-1 hubs placed directly outside the perimeter firewall to mirror raw traffic into analysis buffers.

Answer

Disabling all stateful inspection engines on perimeter firewalls to maximize throughput for inbound HTTPS sessions.

Question 11

Which THREE of the following are examples of how network segmentation supports the principle of defense in depth?

Accepted Answer

It restricts lateral movement for an attacker who has compromised a device.. Network segmentation breaks a flat network into smaller, isolated subnets. This limits the blast radius of a breach by preventing lateral movement, restricting access to sensitive data, and providing points to inspect traffic between zones. By enforcing boundaries, the organization ensures that an attacker who compromises a workstation in one zone cannot easily pivot to critical servers in another, thus creating multiple functional barriers that the attacker must overcome to reach the high-value targets.

Answer

It eliminates the need for host-based firewalls on individual servers.

Answer

It automatically encrypts all data in transit between segments.

Question 12

Which TWO of the following are primary objectives of implementing a defense in depth strategy in a corporate environment?

Accepted Answer

To increase the difficulty and cost for an attacker to succeed.. Defense in depth aims to delay attackers, increase the probability of detection, and ensure that a single point of failure does not lead to a total security compromise. These objectives are achieved by creating layers that require an attacker to defeat multiple, distinct security measures. This approach is essential for modern enterprises where perimeter defenses can be bypassed via phishing or zero-day vulnerabilities, making internal detection and mitigation capabilities absolutely vital.

Answer

To eliminate the need for regular security patching.

Answer

To replace the requirement for user security awareness training.

Answer

To centralize all logs into a single storage location.

Question 13

When configuring endpoint security, which THREE of the following are considered 'defense-in-depth' measures to protect against ransomware?

Accepted Answer

Applying the Principle of Least Privilege (PoLP) to user file shares.. Defense-in-depth requires multiple layers of security to ensure that if one control fails, others are present to mitigate the impact. For ransomware, this includes preventing the execution, limiting the scope of damage through permissions, and maintaining immutable backups. These layers ensure that an attacker must overcome multiple, diverse obstacles to achieve their objective of data encryption, significantly increasing the difficulty of a successful attack.

Answer

Disabling all network connections to the endpoint.

Answer

Enabling guest access for easier file sharing across departments.

Question 14

An IT security team is auditing Windows Update for Business configurations across a multi-site enterprise. Which TWO methods can be utilized by administrators to successfully deploy and enforce these cloud-linked update policies? (Choose TWO)

Accepted Answer

Group Policy Objects (GPOs) applied through Active Directory domains. Windows Update for Business policies can be administered flexibly through traditional enterprise Group Policy or modern cloud-based Mobile Device Management solutions like Microsoft Intune. Providing multiple management pathways enables organizations managing hybrid or fully cloud-native environments to enforce consistent update governance uniformly.

Answer

Manual execution of local PowerShell scripts by end-users with standard privileges

Answer

Direct packet injection via public Wi-Fi access points during routine employee travel

Answer

Editing local security policy templates manually on every individual client workstation

Question 15

Which TWO of the following are primary functions of a Public Key Infrastructure (PKI)?

Accepted Answer

Issuance of digital certificates to verify identity.. PKI is vital for managing the lifecycle of digital certificates, ensuring trust in identity. By providing mechanisms for issuance and revocation, PKI allows entities to communicate securely without pre-existing trust. Understanding these functions is essential for GSEC professionals to manage authentication and secure communication channels effectively within an enterprise architecture, preventing the use of expired or fraudulent credentials that could be exploited by malicious actors during network sessions.

Answer

Centralized distribution of symmetric keys.

Answer

Hardware-level encryption for disk storage.

Answer

Real-time traffic flow monitoring and alerting.

Question 16

A retail company is reviewing its defense in depth strategy after a breach where an attacker used stolen credentials to access a database server. The investigation showed that the server had no host-based logging, and database activity was not monitored. Which TWO controls should be added to improve detection of similar future attacks? (Choose two.)

Accepted Answer

Deploying host-based intrusion detection system (HIDS) agents on database servers. The breach exploited stolen credentials to access a database server, and the gaps were lack of host-based logging and database activity monitoring. HIDS agents provide host-level visibility into attacker actions, while DAM logs and alerts on suspicious database queries. Together they create detective controls that would likely have identified the unauthorized access. The other options are preventive or confidentiality controls that do not address the detection gap.

Answer

Enforcing a password complexity policy for all database accounts

Answer

Implementing full-disk encryption on the database server

Answer

Configuring a next-generation firewall to block outbound traffic from the database server

Question 17

A security analyst is reviewing how a file encryption tool protects data at rest on employee laptops. The tool must ensure that an attacker who copies the encrypted file cannot decrypt it without also obtaining the user's passphrase, and that modification of the ciphertext is detectable. Which TWO design elements should the analyst verify are present? (Choose two.)

Accepted Answer

A password-based key derivation function with a unique random salt and a high iteration count is used to derive the file encryption key.. A salted, high-iteration KDF makes passphrase guessing expensive and prevents cross-file precomputation, while authenticated encryption binds a tag to the ciphertext so any modification is detected. Together they ensure a copied file cannot be decrypted without the passphrase and that tampering is evident.

Answer

The file is encrypted with a stream cipher using a nonce that is reused across all files for simplicity.

Answer

A static initialization vector equal to the file creation timestamp is used for every encryption operation to ensure reproducibility.

Answer

The encryption key is embedded in the file header obfuscated with Base64 so the tool can decrypt without prompting the user.

Question 18

A security administrator is hardening a fleet of Windows 10 endpoints against credential theft attacks such as Pass-the-Hash and credential dumping. Which TWO of the following measures directly mitigate these threats by protecting credentials in memory and restricting their use? (Choose two.)

Accepted Answer

Enable Credential Guard. Credential Guard and LSA protection directly protect credentials in memory. Credential Guard isolates derived credentials using virtualization-based security, preventing their theft. LSA protection blocks non-PPL processes from reading LSA memory, thwarting credential dumping tools. SMB signing, Windows Defender Firewall, and BitLocker address other security aspects but do not directly prevent credential theft from memory.

Answer

Enable BitLocker with TPM

Answer

Enforce SMB signing

Answer

Deploy Windows Defender Firewall with domain profile

Question 19

A company's incident response plan requires a formal lessons-learned review after a major ransomware incident. Which TWO activities are appropriate during the Post-Incident Activity phase? (Choose two.)

Accepted Answer

Conduct a meeting with stakeholders to review what worked, what failed, and how to improve the plan.. The Post-Incident Activity phase is about learning from the incident and improving future response. Holding a stakeholder review meeting and updating the IR plan and detection rules based on findings both directly serve that purpose. Recovery and eradication actions belong to earlier phases, and containment is likewise an earlier-phase activity, so they are not appropriate here.

Answer

Reimage all affected endpoints and restore data from the most recent backups.

Answer

Isolate the compromised network segment to prevent the ransomware from spreading further.

Answer

Eradicate the ransomware binaries and remove persistence mechanisms from infected hosts.

Question 20

A security architect is designing a defensible network architecture for a new campus. The architect must implement controls that limit the spread of malware from an infected endpoint to other endpoints on the same VLAN. Which TWO actions should be included in the design? (Choose two.)

Accepted Answer

Implement 802.1X with dynamic VLAN assignment so endpoints are placed into role-based segments based on identity and posture.. Limiting malware spread on a campus network requires segmenting endpoints at Layer 2. 802.1X with dynamic VLAN assignment places devices into role-based segments, and private VLANs prevent direct host-to-host communication within a VLAN. Together they reduce the blast radius of an infection. Honeypots, DHCP snooping with IP Source Guard, and host-based IPS improve detection or integrity but do not provide the network segmentation needed to contain lateral movement.

Answer

Implement a host-based intrusion prevention system (HIPS) on every endpoint to block malicious traffic at the source.

Answer

Deploy a honeypot on each VLAN to detect and automatically blackhole infected endpoints.

Answer

Configure DHCP snooping and IP Source Guard on all access ports to validate endpoint IP and MAC bindings.