GSEC Quick Quiz — 10 Questions

Question 1

When designing a secure container orchestration strategy, which approach best minimizes the impact of a compromised container on the host kernel?

Accepted Answer

Use a specialized container runtime like gVisor to intercept system calls.. Kernel vulnerabilities are a primary vector for container escapes. By using technologies like gVisor or Kata Containers, the container environment uses a hardened kernel or a separate micro-VM, providing an additional layer of isolation. Standard containers share the host kernel directly; if the kernel is exploited via a system call, the attacker can break out of the container boundary entirely, leading to full system compromise of the underlying host node.

Answer

Disable all kernel modules on the host operating system.

Answer

Increase the memory limit for every container in the cluster.

Answer

Run all containers with the --privileged flag to ensure compatibility.

Question 2

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Accepted Answer

It maps Security Identifiers (SIDs) to user profile directories.. The ProfileList key maps SIDs to user profile paths. This is critical because an attacker may create a temporary or hidden account. By identifying the exact path to the user profile, the investigator knows where to look for user-specific artifacts like NTUSER.DAT, browser history, and temporary files. This mapping is the starting point for scoping user-level malicious activities and ensuring that no hidden accounts are overlooked during the investigation.

Answer

It defines the system's default language settings.

Answer

It logs every application the user has executed.

Answer

It lists all installed software on the system.

Question 3

A company stores backup tapes offsite. An auditor notes that the tapes contain sensitive customer data and are transported by a third-party courier. The security manager wants to ensure that a lost tape cannot expose customer information. Which control best addresses this risk?

Accepted Answer

Encrypt the backup tapes using AES-256 with keys managed separately from the tapes.. The risk is that a lost or stolen tape exposes customer data, so the control must make the data unreadable without authorization. Encrypting tapes with AES-256 and storing keys separately achieves this directly. NDAs, GPS tracking, and shorter retention periods address accountability, recovery, or exposure windows but leave the tape contents readable if the media falls into the wrong hands.

Answer

Require the courier to sign a non-disclosure agreement and provide chain-of-custody documentation.

Answer

Install GPS trackers on the transport vehicle and monitor the route in real time.

Answer

Reduce the backup retention period from one year to thirty days to limit exposure.

Question 4

A financial institution is implementing a new access control system for its trading floor. The security team must enforce a model that supports dynamic, fine-grained access decisions based on user attributes, resource attributes, and environmental conditions such as time of day. The system must also allow for centralized policy management and auditing. Which TWO of the following access control models best fit these requirements? (Choose two.)

Accepted Answer

Policy-Based Access Control (PBAC). Attribute-Based Access Control and Policy-Based Access Control both support dynamic, fine-grained access decisions using attributes and environmental conditions. They allow centralized policy management and auditing, which are critical for the financial institution. RBAC, MAC, and DAC lack the necessary flexibility and context-awareness. Therefore, ABAC and PBAC are the correct choices.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 5

A security administrator is reviewing web server logs and notices a high volume of requests with different User-Agent strings, all targeting the same URL with varying query parameters. The requests appear to be attempting to inject SQL commands. Which of the following is the most effective mitigation to prevent SQL injection in this scenario?

Accepted Answer

Use parameterized queries (prepared statements) for all database access.. SQL injection occurs when user input is improperly concatenated into SQL queries. Parameterized queries, also known as prepared statements, ensure that input is bound as parameters and never interpreted as SQL code. This eliminates the vulnerability entirely. While WAFs and input validation can help, they are not as reliable or comprehensive. Therefore, using parameterized queries is the most effective mitigation.

Answer

Deploy a Web Application Firewall (WAF) with SQL injection signatures.

Answer

Implement strict input validation to allow only alphanumeric characters.

Answer

Encode all user input using HTML entity encoding before storing in the database.

Question 6

A security engineer is configuring a new AWS S3 bucket to store sensitive PII. Which combination of settings best adheres to the principle of least privilege for the bucket policy?

Accepted Answer

Restrict access to specific IAM roles and require Secure Transport.. Proper S3 configuration requires a defense-in-depth approach that prevents public access while explicitly restricting actions to necessary services. By blocking public access, enforcing TLS for transit, and using explicit IAM roles, the organization minimizes the attack surface. This is vital because S3 buckets are frequent targets for misconfiguration that leads to data exposure, making granular policy control an essential defensive requirement for protecting cloud-based sensitive information.

Answer

Enable public access and rely on bucket ACLs for granular object permission.

Answer

Assign full administrative rights to the bucket root user for ease of management.

Answer

Use a wildcard principal in the bucket policy to allow internal cross-account access.

Question 7

A financial services firm has deployed a next-generation firewall at its internet perimeter, host-based firewalls on every workstation, and VLAN segmentation between departments. During a purple-team exercise, analysts discover that a contractor's laptop, once connected to the internal network, can reach the HR payroll server directly over SMB. The security team wants to enforce the principle of least privilege on this internal traffic. Which control should they implement to best achieve this?

Accepted Answer

Implement internal microsegmentation with host-based firewall rules that allow only authorized HR subnets to reach the payroll server on TCP 445.. The contractor's laptop is an internal host, so perimeter and network-based detective controls do not stop it from reaching the payroll server. Microsegmentation with host-based firewall rules enforces least privilege by permitting only the HR subnet to use SMB against that server. This limits lateral movement and adds a granular layer of defense that complements existing perimeter and segmentation controls.

Answer

Deploy an intrusion prevention system (IPS) on the internal network to block SMB exploits.

Answer

Enable port security on the access switch to limit the number of MAC addresses per port.

Answer

Configure the perimeter firewall to block all inbound SMB traffic from the internet.

Question 8

Refer to the exhibit. An administrator runs the provided command on a macOS device to verify the security configuration. Given the output, what is the most appropriate interpretation regarding the security posture of this endpoint?

Accepted Answer

The endpoint's kernel integrity protections are actively enforced.. The output confirms that System Integrity Protection is currently active on the host. This status indicates that the core OS protections are enforced, preventing unauthorized modification of system-protected locations and restricted kernel operations. In a GSEC context, confirming the status of SIP is a primary validation step during an incident response or security audit, as disabling SIP is a common technique used by attackers to gain persistence and evade detection on macOS.

Answer

The endpoint is vulnerable to root-level system file modification.

Answer

The disk encryption configuration is currently failing.

Answer

The device has been successfully compromised by a kernel rootkit.

Question 9

An organization is implementing TLS 1.3 for a new customer portal. During the cipher suite negotiation phase, the security engineer needs to ensure that perfect forward secrecy is maintained for all incoming sessions. Which underlying key exchange mechanism should be prioritized in the configuration?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral. Perfect forward secrecy ensures that session keys are not compromised even if the primary private key of the server is compromised in the future. Ephemeral Diffie-Hellman guarantees this by generating unique per-session parameters that are never stored persistently on disk. Proper enforcement prevents long-term bulk decryption of historical intercepted traffic.

Answer

RSA key transport mechanism

Answer

Pre-Shared Key authentication mode

Answer

Static Diffie-Hellman key agreement

Question 10

Refer to the exhibit. An investigator is auditing logon events. Which Event ID indicates a successful network logon (Type 3) to the machine?

Accepted Answer

Event ID 4624 with Logon Type 3. Event ID 4624 records successful logons, and the Logon Type field specifies the method used. A Type 3 logon represents a network connection, often associated with remote file access or service authentication. Identifying these events is essential for detecting lateral movement or unauthorized access via SMB, as attackers frequently use network logons to propagate through a compromised environment using stolen credentials.

Answer

Event ID 4625

Answer

Event ID 4624 with Logon Type 2

Answer

Event ID 4672