GSEC Networking and Protocols — 15 Questions

Question 1

An incident responder is analyzing a compromised corporate workstation and finds evidence of DNS poisoning in the local cache. Which THREE indicators or mitigation strategies are most relevant to identifying and preventing this specific threat? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implementation of DNS Security Extensions (DNSSEC) to validate cryptographic signatures.. DNS poisoning attacks corrupt the local resolver cache, redirecting users to malicious infrastructure. Effective detection involves monitoring for high query volumes and mismatched response IDs, while defense-in-depth relies on enforcing DNSSEC validation and utilizing trusted, encrypted resolvers like DNS over HTTPS to guarantee cryptographic authenticity.

Answer

Abnormally high transaction ID variance within recursive DNS server query logs.

Answer

Disabling all outbound UDP traffic on ports other than 53 and 123 across gateways.

Question 2

An analyst reviewing packet captures notices that a client completed a TCP handshake with a server, sent a request, and then the server sent a packet with the RST flag set immediately after receiving the request. The client had no prior connection to that port. What is the most likely explanation for the RST?

Accepted Answer

The server's TCP stack received a segment for a connection it does not have in its connection table, so it replied with RST.. TCP uses the RST flag to abort a connection when a segment arrives that cannot be matched to an existing connection, or when a connection is closed abruptly. Because the handshake completed, a listening socket accepted the connection, but the request may have been processed by a socket that was subsequently closed or the server's state was reset. The stack then responds with RST to any further segment.

Answer

The server received a duplicate ACK for data it had already acknowledged and used RST to signal the error.

Answer

The client sent a SYN with an invalid checksum, so the server rejected the connection with RST.

Answer

The server's firewall detected the request payload as malicious and injected a RST to tear down the session.

Question 3

A security analyst suspects an internal host is communicating with a command-and-control server using DNS tunneling. Which network protocol characteristic should the analyst examine to best identify this malicious behavior?

Accepted Answer

Unusually high frequency and elevated entropy levels within TXT or subdomain record queries.. DNS tunneling embeds arbitrary data inside standard DNS queries and responses, primarily utilizing TXT, NULL, or subdomains of A records. Analysing query length and entropy helps security professionals detect abnormal payload sizes that deviate from legitimate domain name resolution patterns, protecting enterprise networks from stealthy data exfiltration and C2 channels.

Answer

TCP connection state tables showing persistent half-open sessions on port 53.

Answer

Frequent receipt of ICMP Destination Unreachable messages indicating blocked UDP traffic.

Answer

Elevated round-trip time latency on standard HTTP GET requests traversing proxy servers.

Question 4

An administrator needs to harden a corporate switch infrastructure against unauthorized device connections and Man-in-the-Middle attacks. Which combination of Layer 2 security controls provides the most comprehensive defense against both DHCP spoofing and ARP poisoning?

Accepted Answer

Deploying Dynamic ARP Inspection paired with an active DHCP Snooping binding table.. DHCP Snooping builds a trusted binding database by intercepting DHCP messages on untrusted ports, while Dynamic ARP Inspection utilizes this database to drop forged ARP replies. Implementing both mitigates rogue DHCP servers and prevents ARP cache poisoning attacks, securing Layer 2 communications from interception and spoofing without relying solely on static configurations.

Answer

Implementing Port Security along with Static ARP entries on all critical endpoints.

Answer

Enabling BPDU Guard and Root Guard on all designated edge access ports.

Answer

Configuring VLAN Access Control Lists alongside private VLAN isolated port modes.

Question 5

During a routine vulnerability assessment, an analyst discovers that a network router is responding to ICMP Timestamp requests. What is the primary security risk associated with enabling this service on perimeter networking equipment?

Accepted Answer

Allowing unauthorized entities to gather precise system uptime and clock synchronization data.. Responding to ICMP Timestamp requests leaks the exact system uptime and local clock settings to unauthenticated external entities. Attackers use this timing information to fingerprint operating systems, map network latency anomalies, and design precise timing attacks against time-dependent cryptographic protocols and authentication tokens.

Answer

Enabling remote attackers to execute arbitrary shell commands via buffer overflows in the ICMP daemon.

Answer

Exposing internal private IP address ranges through embedded DNS zone transfer responses.

Answer

Facilitating high-bandwidth distributed denial-of-service reflection attacks using small spoofed packets.

Question 6

During a forensic investigation of a compromised web application server, a security analyst discovers that outbound administrative traffic is flowing over unexpected ports and non-standard protocols. Which security architecture control should have been implemented at the network perimeter to restrict this unauthorized outbound communication?

Accepted Answer

Enforcing strict Egress Filtering policies on internal router and firewall interfaces.. Egress filtering inspects and restricts outbound traffic leaving the internal network to ensure only authorized business protocols and ports can traverse the perimeter. Implementing strict egress filtering prevents compromised hosts from communicating with external command-and-control servers or exfiltrating data via unauthorized ports.

Answer

Deploying a traditional static packet-filtering firewall with inbound rule sets.

Answer

Configuring port security on all access layer switch ports to limit MAC addresses.

Answer

Implementing WPA3 Enterprise wireless security across all corporate access points.

Question 7

An administrator observes a series of SYN packets originating from an internal workstation targeting random ports on various external IP addresses. The traffic is not resulting in established TCP connections. What is the most likely purpose of this network behavior?

Accepted Answer

The host is performing TCP half-open reconnaissance.. The behavior described is characteristic of a TCP port scan. By sending SYN packets without completing the three-way handshake, the attacker identifies open services while attempting to minimize detection. Understanding reconnaissance techniques is vital for network defense, as these scans often precede targeted exploitation attempts. Security analysts must identify such patterns early to implement egress filtering or isolate the compromised host before it initiates a more severe attack.

Answer

The workstation is performing a standard DNS resolution process.

Answer

The system is initiating a legitimate peer-to-peer file transfer.

Answer

The network interface is experiencing a broadcast storm.

Question 8

A security analyst needs to ensure that sensitive data in transit between two internal servers remains confidential and authenticated. Which protocol provides the most robust security for this requirement?

Accepted Answer

IPsec. IPsec provides end-to-end security at the network layer, ensuring that all data between the two endpoints is encrypted and authenticated regardless of the underlying application. This is essential for protecting sensitive traffic within a private network from sniffing or spoofing. Implementing IPsec allows for granular control over traffic security policies, making it a standard requirement for high-security environments where network-level protection is prioritized over application-specific encryption.

Answer

Telnet

Answer

HTTP

Answer

SNMPv1

Question 9

Which TWO of the following statements accurately describe the characteristics of UDP compared to TCP?

Accepted Answer

UDP is faster due to the lack of a handshake.. UDP is a connectionless, datagram-oriented protocol that prioritizes speed and efficiency over reliability. It does not perform handshakes, flow control, or error correction, making it ideal for real-time applications like VoIP. TCP, conversely, provides a reliable stream by managing connections and acknowledging packet delivery. Understanding these differences is crucial for firewall configuration, as security policies must account for the stateless nature of UDP versus the stateful requirements of TCP.

Answer

UDP provides guaranteed delivery of packets.

Answer

UDP uses flow control to manage data transmission rates.

Answer

UDP is the primary protocol for HTTP web traffic.

Question 10

An analyst reviewing packet captures from a corporate network sees a workstation send an ARP request for the default gateway's IP address. Within milliseconds, two different ARP replies arrive from two different MAC addresses, and the workstation begins forwarding all off-subnet traffic to the second MAC. The analyst suspects an on-path attack. Which security control would most directly prevent this specific behavior on the local segment?

Accepted Answer

Configuring Dynamic ARP Inspection with a DHCP snooping binding table. Dynamic ARP Inspection is the control specifically designed to stop forged ARP replies. By relying on the DHCP snooping binding table as its source of truth for which MAC legitimately owns which IP, the switch can drop any ARP packet whose sender information does not match an authorized binding. This blocks the attacker's spoofed reply before the workstation can poison its cache and redirect off-subnet traffic.

Answer

Enabling private VLAN edge isolation between access ports

Answer

Deploying 802.1X port-based network access control on access ports

Answer

Enabling Spanning Tree Protocol on all access switches

Question 11

A network engineer is deploying a new IDS sensor on a switched segment and needs it to see all unicast traffic between two hosts on the same VLAN, including traffic not addressed to the sensor. The switch supports port mirroring. Which configuration should the engineer implement?

Accepted Answer

Configure a SPAN session on the switch, designating the sensor port as the destination and the VLAN or relevant ports as the source.. On a switch, unicast frames are forwarded only out the port leading to the destination MAC, so a sensor on an ordinary access port cannot see other hosts' conversations. A SPAN session with the sensor as the destination port and the monitored ports or VLAN as the source copies those frames to the sensor. This preserves normal forwarding while giving the IDS the full traffic view it needs.

Answer

Create an EtherChannel bundle between the sensor and the switch, and enable trunking on the link.

Answer

Configure a SPAN session on the switch, designating the sensor port as the source and the monitored host ports as the destination.

Answer

Enable promiscuous mode on the sensor NIC and connect it to an access port in the same VLAN as the two hosts.

Question 12

A security analyst is reviewing a packet capture of traffic between a user workstation and a public web server. The analyst observes the workstation completing a three-way handshake on TCP port 443, then negotiating encryption parameters, and finally requesting a specific resource path. The analyst wants to confirm that the client verified the identity of the server before any application data was sent. Which protocol mechanism in this exchange provides that server identity verification?

Accepted Answer

The TLS handshake, where the server presents a certificate and the client validates it against trusted certificate authorities.. Server identity in HTTPS is established during the TLS handshake, where the server proves possession of a private key matching a certificate that the client validates against trusted roots and the requested hostname. The TCP handshake merely creates the connection, and application headers such as Host are client-supplied and unauthenticated. Confirming the certificate chain is what binds the session to a verified server identity.

Answer

The server's TCP initial sequence number, which is randomized to prevent session hijacking.

Answer

The HTTP Host header, which tells the server which virtual host the client intends to reach.

Answer

The TCP SYN, SYN-ACK, ACK sequence confirms the server's identity before data transfer.

Question 13

A network engineer is documenting how a workstation obtains an IPv4 address on a corporate LAN. The engineer observes the workstation broadcasting a request, receiving a unicast offer from a server, broadcasting a formal request for that address, and finally receiving an acknowledgment. The engineer must record which transport protocol and ports this address-assignment exchange uses. Which combination correctly describes the exchange?

Accepted Answer

UDP ports 67 and 68, with the server listening on 67 and the client on 68.. DHCP performs address assignment over UDP, with the server on port 67 and the client on port 68, because the client must broadcast before it possesses an address. The DORA sequence (Discover, Offer, Request, Acknowledge) matches the observed broadcast request, unicast offer, broadcast request, and acknowledgment. TCP and the other listed protocols cannot provide this broadcast-based assignment.

Answer

UDP ports 53 and 54, because the address server acts as a directory service.

Answer

ICMP type 4 and type 5 messages, because routers advertise addresses to local hosts.

Answer

TCP ports 67 and 68, because address assignment requires a reliable connection.

Question 14

A security team is designing a network segmentation scheme for a new data center. They want to restrict lateral movement between workloads and enforce policy based on workload identity rather than IP address. Which TWO technologies best support this goal? (Choose two.)

Accepted Answer

Microsegmentation using a software-defined overlay with workload-level policy enforcement.. Restricting lateral movement and enforcing workload-identity policy requires controls that operate on east-west traffic and understand workload context. Microsegmentation with a software-defined overlay enforces per-workload policy regardless of IP, and a next-generation firewall with identity-based rules can inspect and permit only authorized workload flows. Together they address both the segmentation and identity-policy requirements.

Answer

VLANs assigned by physical switch port with inter-VLAN routing disabled.

Answer

A perimeter firewall with rules based on source and destination IP addresses.

Answer

802.1X port-based network access control on all switch ports.

Question 15

A security engineer is analyzing why a remote user's VPN session intermittently fails to reach internal resources even though the tunnel itself stays up. Packet captures show large packets are dropped while small ones succeed, and the engineer suspects a path MTU discovery problem. Which TWO conditions would cause this behavior on the path between the client and the internal server? (Choose two.)

Accepted Answer

An intermediate firewall blocks all ICMP Destination Unreachable messages, including the fragmentation-needed type.. Path MTU discovery relies on ICMP fragmentation-needed messages to signal senders to shrink packets. Filtering those ICMP messages, or setting the Don't Fragment bit on encapsulated packets larger than the real path MTU, leaves the sender unaware and causes silent drops of large packets while small ones pass. Both conditions match the observed size-dependent failure.

Answer

The internal server uses a smaller TCP receive window than the client advertises during the handshake.

Answer

The client's DNS resolver returns a stale record pointing to a decommissioned server address.

Answer

The client and server negotiated a weak cipher suite during the VPN handshake.