GSEC Networking and Protocols — Timed 10 Questions

Question 1

An incident responder is analyzing a compromised corporate workstation and finds evidence of DNS poisoning in the local cache. Which THREE indicators or mitigation strategies are most relevant to identifying and preventing this specific threat? (Choose three)

10 minute time limit — choose an answer to begin.

Accepted Answer

Implementation of DNS Security Extensions (DNSSEC) to validate cryptographic signatures.. DNS poisoning attacks corrupt the local resolver cache, redirecting users to malicious infrastructure. Effective detection involves monitoring for high query volumes and mismatched response IDs, while defense-in-depth relies on enforcing DNSSEC validation and utilizing trusted, encrypted resolvers like DNS over HTTPS to guarantee cryptographic authenticity.

Answer

Abnormally high transaction ID variance within recursive DNS server query logs.

Answer

Disabling all outbound UDP traffic on ports other than 53 and 123 across gateways.

Question 2

An analyst reviewing packet captures notices that a client completed a TCP handshake with a server, sent a request, and then the server sent a packet with the RST flag set immediately after receiving the request. The client had no prior connection to that port. What is the most likely explanation for the RST?

Accepted Answer

The server's TCP stack received a segment for a connection it does not have in its connection table, so it replied with RST.. TCP uses the RST flag to abort a connection when a segment arrives that cannot be matched to an existing connection, or when a connection is closed abruptly. Because the handshake completed, a listening socket accepted the connection, but the request may have been processed by a socket that was subsequently closed or the server's state was reset. The stack then responds with RST to any further segment.

Answer

The server received a duplicate ACK for data it had already acknowledged and used RST to signal the error.

Answer

The client sent a SYN with an invalid checksum, so the server rejected the connection with RST.

Answer

The server's firewall detected the request payload as malicious and injected a RST to tear down the session.

Question 3

A security analyst suspects an internal host is communicating with a command-and-control server using DNS tunneling. Which network protocol characteristic should the analyst examine to best identify this malicious behavior?

Accepted Answer

Unusually high frequency and elevated entropy levels within TXT or subdomain record queries.. DNS tunneling embeds arbitrary data inside standard DNS queries and responses, primarily utilizing TXT, NULL, or subdomains of A records. Analysing query length and entropy helps security professionals detect abnormal payload sizes that deviate from legitimate domain name resolution patterns, protecting enterprise networks from stealthy data exfiltration and C2 channels.

Answer

TCP connection state tables showing persistent half-open sessions on port 53.

Answer

Frequent receipt of ICMP Destination Unreachable messages indicating blocked UDP traffic.

Answer

Elevated round-trip time latency on standard HTTP GET requests traversing proxy servers.

Question 4

An administrator needs to harden a corporate switch infrastructure against unauthorized device connections and Man-in-the-Middle attacks. Which combination of Layer 2 security controls provides the most comprehensive defense against both DHCP spoofing and ARP poisoning?

Accepted Answer

Deploying Dynamic ARP Inspection paired with an active DHCP Snooping binding table.. DHCP Snooping builds a trusted binding database by intercepting DHCP messages on untrusted ports, while Dynamic ARP Inspection utilizes this database to drop forged ARP replies. Implementing both mitigates rogue DHCP servers and prevents ARP cache poisoning attacks, securing Layer 2 communications from interception and spoofing without relying solely on static configurations.

Answer

Implementing Port Security along with Static ARP entries on all critical endpoints.

Answer

Enabling BPDU Guard and Root Guard on all designated edge access ports.

Answer

Configuring VLAN Access Control Lists alongside private VLAN isolated port modes.

Question 5

During a routine vulnerability assessment, an analyst discovers that a network router is responding to ICMP Timestamp requests. What is the primary security risk associated with enabling this service on perimeter networking equipment?

Accepted Answer

Allowing unauthorized entities to gather precise system uptime and clock synchronization data.. Responding to ICMP Timestamp requests leaks the exact system uptime and local clock settings to unauthenticated external entities. Attackers use this timing information to fingerprint operating systems, map network latency anomalies, and design precise timing attacks against time-dependent cryptographic protocols and authentication tokens.

Answer

Enabling remote attackers to execute arbitrary shell commands via buffer overflows in the ICMP daemon.

Answer

Exposing internal private IP address ranges through embedded DNS zone transfer responses.

Answer

Facilitating high-bandwidth distributed denial-of-service reflection attacks using small spoofed packets.

Question 6

During a forensic investigation of a compromised web application server, a security analyst discovers that outbound administrative traffic is flowing over unexpected ports and non-standard protocols. Which security architecture control should have been implemented at the network perimeter to restrict this unauthorized outbound communication?

Accepted Answer

Enforcing strict Egress Filtering policies on internal router and firewall interfaces.. Egress filtering inspects and restricts outbound traffic leaving the internal network to ensure only authorized business protocols and ports can traverse the perimeter. Implementing strict egress filtering prevents compromised hosts from communicating with external command-and-control servers or exfiltrating data via unauthorized ports.

Answer

Deploying a traditional static packet-filtering firewall with inbound rule sets.

Answer

Configuring port security on all access layer switch ports to limit MAC addresses.

Answer

Implementing WPA3 Enterprise wireless security across all corporate access points.

Question 7

An administrator observes a series of SYN packets originating from an internal workstation targeting random ports on various external IP addresses. The traffic is not resulting in established TCP connections. What is the most likely purpose of this network behavior?

Accepted Answer

The host is performing TCP half-open reconnaissance.. The behavior described is characteristic of a TCP port scan. By sending SYN packets without completing the three-way handshake, the attacker identifies open services while attempting to minimize detection. Understanding reconnaissance techniques is vital for network defense, as these scans often precede targeted exploitation attempts. Security analysts must identify such patterns early to implement egress filtering or isolate the compromised host before it initiates a more severe attack.

Answer

The workstation is performing a standard DNS resolution process.

Answer

The system is initiating a legitimate peer-to-peer file transfer.

Answer

The network interface is experiencing a broadcast storm.

Question 8

A security analyst needs to ensure that sensitive data in transit between two internal servers remains confidential and authenticated. Which protocol provides the most robust security for this requirement?

Accepted Answer

IPsec. IPsec provides end-to-end security at the network layer, ensuring that all data between the two endpoints is encrypted and authenticated regardless of the underlying application. This is essential for protecting sensitive traffic within a private network from sniffing or spoofing. Implementing IPsec allows for granular control over traffic security policies, making it a standard requirement for high-security environments where network-level protection is prioritized over application-specific encryption.

Answer

Telnet

Answer

HTTP

Answer

SNMPv1

Question 9

Which TWO of the following statements accurately describe the characteristics of UDP compared to TCP?

Accepted Answer

UDP is faster due to the lack of a handshake.. UDP is a connectionless, datagram-oriented protocol that prioritizes speed and efficiency over reliability. It does not perform handshakes, flow control, or error correction, making it ideal for real-time applications like VoIP. TCP, conversely, provides a reliable stream by managing connections and acknowledging packet delivery. Understanding these differences is crucial for firewall configuration, as security policies must account for the stateless nature of UDP versus the stateful requirements of TCP.

Answer

UDP provides guaranteed delivery of packets.

Answer

UDP uses flow control to manage data transmission rates.

Answer

UDP is the primary protocol for HTTP web traffic.

Question 10

An analyst reviewing packet captures from a corporate network sees a workstation send an ARP request for the default gateway's IP address. Within milliseconds, two different ARP replies arrive from two different MAC addresses, and the workstation begins forwarding all off-subnet traffic to the second MAC. The analyst suspects an on-path attack. Which security control would most directly prevent this specific behavior on the local segment?

Accepted Answer

Configuring Dynamic ARP Inspection with a DHCP snooping binding table. Dynamic ARP Inspection is the control specifically designed to stop forged ARP replies. By relying on the DHCP snooping binding table as its source of truth for which MAC legitimately owns which IP, the switch can drop any ARP packet whose sender information does not match an authorized binding. This blocks the attacker's spoofed reply before the workstation can poison its cache and redirect off-subnet traffic.

Answer

Enabling private VLAN edge isolation between access ports

Answer

Deploying 802.1X port-based network access control on access ports

Answer

Enabling Spanning Tree Protocol on all access switches