GSEC Practice Questions

Question 1

When designing a secure container orchestration strategy, which approach best minimizes the impact of a compromised container on the host kernel?

Accepted Answer

Use a specialized container runtime like gVisor to intercept system calls.. Kernel vulnerabilities are a primary vector for container escapes. By using technologies like gVisor or Kata Containers, the container environment uses a hardened kernel or a separate micro-VM, providing an additional layer of isolation. Standard containers share the host kernel directly; if the kernel is exploited via a system call, the attacker can break out of the container boundary entirely, leading to full system compromise of the underlying host node.

Answer

Disable all kernel modules on the host operating system.

Answer

Increase the memory limit for every container in the cluster.

Answer

Run all containers with the --privileged flag to ensure compatibility.

Question 2

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Accepted Answer

It maps Security Identifiers (SIDs) to user profile directories.. The ProfileList key maps SIDs to user profile paths. This is critical because an attacker may create a temporary or hidden account. By identifying the exact path to the user profile, the investigator knows where to look for user-specific artifacts like NTUSER.DAT, browser history, and temporary files. This mapping is the starting point for scoping user-level malicious activities and ensuring that no hidden accounts are overlooked during the investigation.

Answer

It defines the system's default language settings.

Answer

It logs every application the user has executed.

Answer

It lists all installed software on the system.

Question 3

A company stores backup tapes offsite. An auditor notes that the tapes contain sensitive customer data and are transported by a third-party courier. The security manager wants to ensure that a lost tape cannot expose customer information. Which control best addresses this risk?

Accepted Answer

Encrypt the backup tapes using AES-256 with keys managed separately from the tapes.. The risk is that a lost or stolen tape exposes customer data, so the control must make the data unreadable without authorization. Encrypting tapes with AES-256 and storing keys separately achieves this directly. NDAs, GPS tracking, and shorter retention periods address accountability, recovery, or exposure windows but leave the tape contents readable if the media falls into the wrong hands.

Answer

Require the courier to sign a non-disclosure agreement and provide chain-of-custody documentation.

Answer

Install GPS trackers on the transport vehicle and monitor the route in real time.

Answer

Reduce the backup retention period from one year to thirty days to limit exposure.

Question 4

A financial institution is implementing a new access control system for its trading floor. The security team must enforce a model that supports dynamic, fine-grained access decisions based on user attributes, resource attributes, and environmental conditions such as time of day. The system must also allow for centralized policy management and auditing. Which TWO of the following access control models best fit these requirements? (Choose two.)

Accepted Answer

Policy-Based Access Control (PBAC). Attribute-Based Access Control and Policy-Based Access Control both support dynamic, fine-grained access decisions using attributes and environmental conditions. They allow centralized policy management and auditing, which are critical for the financial institution. RBAC, MAC, and DAC lack the necessary flexibility and context-awareness. Therefore, ABAC and PBAC are the correct choices.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 5

A security administrator is reviewing web server logs and notices a high volume of requests with different User-Agent strings, all targeting the same URL with varying query parameters. The requests appear to be attempting to inject SQL commands. Which of the following is the most effective mitigation to prevent SQL injection in this scenario?

Accepted Answer

Use parameterized queries (prepared statements) for all database access.. SQL injection occurs when user input is improperly concatenated into SQL queries. Parameterized queries, also known as prepared statements, ensure that input is bound as parameters and never interpreted as SQL code. This eliminates the vulnerability entirely. While WAFs and input validation can help, they are not as reliable or comprehensive. Therefore, using parameterized queries is the most effective mitigation.

Answer

Deploy a Web Application Firewall (WAF) with SQL injection signatures.

Answer

Implement strict input validation to allow only alphanumeric characters.

Answer

Encode all user input using HTML entity encoding before storing in the database.

Question 6

A security engineer is configuring a new AWS S3 bucket to store sensitive PII. Which combination of settings best adheres to the principle of least privilege for the bucket policy?

Accepted Answer

Restrict access to specific IAM roles and require Secure Transport.. Proper S3 configuration requires a defense-in-depth approach that prevents public access while explicitly restricting actions to necessary services. By blocking public access, enforcing TLS for transit, and using explicit IAM roles, the organization minimizes the attack surface. This is vital because S3 buckets are frequent targets for misconfiguration that leads to data exposure, making granular policy control an essential defensive requirement for protecting cloud-based sensitive information.

Answer

Enable public access and rely on bucket ACLs for granular object permission.

Answer

Assign full administrative rights to the bucket root user for ease of management.

Answer

Use a wildcard principal in the bucket policy to allow internal cross-account access.

Question 7

A financial services firm has deployed a next-generation firewall at its internet perimeter, host-based firewalls on every workstation, and VLAN segmentation between departments. During a purple-team exercise, analysts discover that a contractor's laptop, once connected to the internal network, can reach the HR payroll server directly over SMB. The security team wants to enforce the principle of least privilege on this internal traffic. Which control should they implement to best achieve this?

Accepted Answer

Implement internal microsegmentation with host-based firewall rules that allow only authorized HR subnets to reach the payroll server on TCP 445.. The contractor's laptop is an internal host, so perimeter and network-based detective controls do not stop it from reaching the payroll server. Microsegmentation with host-based firewall rules enforces least privilege by permitting only the HR subnet to use SMB against that server. This limits lateral movement and adds a granular layer of defense that complements existing perimeter and segmentation controls.

Answer

Deploy an intrusion prevention system (IPS) on the internal network to block SMB exploits.

Answer

Enable port security on the access switch to limit the number of MAC addresses per port.

Answer

Configure the perimeter firewall to block all inbound SMB traffic from the internet.

Question 8

Refer to the exhibit. An administrator runs the provided command on a macOS device to verify the security configuration. Given the output, what is the most appropriate interpretation regarding the security posture of this endpoint?

Accepted Answer

The endpoint's kernel integrity protections are actively enforced.. The output confirms that System Integrity Protection is currently active on the host. This status indicates that the core OS protections are enforced, preventing unauthorized modification of system-protected locations and restricted kernel operations. In a GSEC context, confirming the status of SIP is a primary validation step during an incident response or security audit, as disabling SIP is a common technique used by attackers to gain persistence and evade detection on macOS.

Answer

The endpoint is vulnerable to root-level system file modification.

Answer

The disk encryption configuration is currently failing.

Answer

The device has been successfully compromised by a kernel rootkit.

Question 9

An organization is implementing TLS 1.3 for a new customer portal. During the cipher suite negotiation phase, the security engineer needs to ensure that perfect forward secrecy is maintained for all incoming sessions. Which underlying key exchange mechanism should be prioritized in the configuration?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral. Perfect forward secrecy ensures that session keys are not compromised even if the primary private key of the server is compromised in the future. Ephemeral Diffie-Hellman guarantees this by generating unique per-session parameters that are never stored persistently on disk. Proper enforcement prevents long-term bulk decryption of historical intercepted traffic.

Answer

RSA key transport mechanism

Answer

Pre-Shared Key authentication mode

Answer

Static Diffie-Hellman key agreement

Question 10

Refer to the exhibit. An investigator is auditing logon events. Which Event ID indicates a successful network logon (Type 3) to the machine?

Accepted Answer

Event ID 4624 with Logon Type 3. Event ID 4624 records successful logons, and the Logon Type field specifies the method used. A Type 3 logon represents a network connection, often associated with remote file access or service authentication. Identifying these events is essential for detecting lateral movement or unauthorized access via SMB, as attackers frequently use network logons to propagate through a compromised environment using stolen credentials.

Answer

Event ID 4625

Answer

Event ID 4624 with Logon Type 2

Answer

Event ID 4672

Question 11

During a forensic examination, you find a Prefetch file named 'MALWARE.EXE-A1B2C3D4.pf'. What is the significance of the hexadecimal string appended to the filename?

Accepted Answer

It is a hash derived from the file's execution path.. Windows Prefetch files store metadata about application execution to speed up startup times. The hash appended to the filename is calculated based on the path from which the application was executed. This allows investigators to differentiate between multiple instances of the same binary running from different directories, which is a common technique used by attackers to hide malicious binaries in non-standard, obfuscated system locations.

Answer

It is a randomized identifier generated at system boot.

Answer

It represents the hash of the file's content.

Answer

It is the timestamp of the last execution.

Question 12

An organization is migrating to a hybrid cloud environment. Which security control is most effective for preventing unauthorized lateral movement between virtual machines residing on the same physical hypervisor?

Accepted Answer

Utilizing micro-segmentation policies via distributed firewalls.. Micro-segmentation is critical in virtualized environments because traditional network perimeter defenses cannot see traffic moving between VMs on the same host. By applying host-based or hypervisor-level firewalls, security teams restrict traffic based on identity and function rather than IP address. This mitigates the risk of a compromised workload pivoting to sensitive internal assets within the shared virtual infrastructure, which is a key security requirement for modern cloud architectures.

Answer

Deploying a Network Intrusion Detection System (NIDS) at the virtual switch level.

Answer

Implementing a traditional hardware-based firewall at the edge of the datacenter.

Answer

Enforcing full disk encryption on all virtual hard drives.

Question 13

After a major security breach, the incident response team conducts a lessons-learned meeting. The team identifies that the initial detection was delayed because log sources were not properly integrated into the SIEM. Which phase of the incident response lifecycle does this finding primarily aim to improve?

Accepted Answer

Preparation. The finding that log sources were not integrated into the SIEM points to a gap in preparation. Preparation involves setting up logging, monitoring, and detection tools. By addressing this, the team enhances future detection capabilities. While the review occurs in Post-Incident Activity, the corrective action targets Preparation.

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 14

A penetration tester is reviewing the TLS configuration of an e-commerce web server. The tester observes that the server prefers the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA during the handshake. Which security weakness does this cipher suite selection introduce?

Accepted Answer

It lacks forward secrecy because the RSA key exchange does not generate ephemeral session keys.. The cipher suite TLS_RSA_WITH_AES_128_CBC_SHA relies on static RSA key exchange, where the client encrypts a premaster secret with the server's public key. This means the session key is tied to the server's long-term private key. If that private key is compromised later, an attacker who recorded the encrypted session can decrypt it retroactively. Forward secrecy requires ephemeral key exchanges like ECDHE or DHE, which generate unique session keys that are not recoverable from the long-term key.

Answer

It uses AES in CBC mode, which is vulnerable to padding oracle attacks such as POODLE.

Answer

It uses SHA-1 for integrity, which is considered cryptographically broken for MACs.

Answer

It allows downgrade to export-grade cryptography because of the RSA key exchange.

Question 15

A security analyst is reviewing logs from a Linux web server that has been compromised. The analyst notices a large number of requests to a specific URL that include encoded characters such as %27, %20, and %3D. The web server logs show these requests in the access log with a 200 OK response. Which type of attack is most likely indicated by these log entries?

Accepted Answer

SQL injection. The encoded characters %27 (single quote), %20 (space), and %3D (equals) are commonly used in SQL injection attempts to manipulate SQL queries. The single quote is used to terminate strings, spaces separate SQL keywords, and equals signs are used in comparisons. The successful 200 OK responses suggest the application may be vulnerable. Other attack types would exhibit different patterns in the logs.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

Command injection

GIAC Security Essentials GSEC practice test

Three ways to study

Study GSEC by domain

Study GSEC by topic

Network Security Devices practice questions

Windows Security Infrastructure practice questions

macOS Security practice questions

Cryptography Application practice questions

Defense in Depth practice questions

Defensible Network Architecture practice questions

Access Control and Password Management practice questions

Cryptography practice questions

Endpoint Security practice questions

Windows Automation and Auditing practice questions

Networking and Protocols practice questions

Linux Fundamentals practice questions

GIAC Security Essentials practice questions