GIAC Security Essentials (GSEC) — Questions 1–75

To be included in browser HSTS preload lists, the domain must be submitted to the preload list service (e.g., hstspreload.org) and meet specific requirements: the HSTS header must include 'includeSubDomains', 'preload', and a max-age of at least 31536000 seconds (one year). The preload directive signals intent, but submission is a separate manual step. This ensures the domain is hardcoded into browsers, providing protection even on the first visit.

Error 0x8007052e is the Windows system code for 'Logon failure: unknown user name or bad password'. This confirms that the service manager attempted to authenticate the service account with Active Directory, but the credentials were rejected, likely due to a password mismatch, expired password, or account lockout.

Disabling password authentication forces the use of cryptographic keys, which are significantly harder to brute-force than even complex passwords. This change effectively eliminates the risk of automated credential stuffing because the server will reject any attempt that does not present a valid private key, regardless of the password's strength.

Identification is the phase where an event is confirmed as an incident and its scope is assessed. The antivirus alert and quarantine confirmation constitute detection and initial validation of a real security event. The analyst has not yet contained, eradicated, or recovered anything, so Identification is the correct phase according to the SANS PICERL model.

Deployment rings allow grouping devices into rings with different deferral periods. By assigning a pilot ring with a short deferral and a broad ring with a longer deferral, IT can validate the update on the pilot ring before it reaches the broader ring. This provides a controlled rollout without Configuration Manager. It is the recommended WUfB approach for validation.

An inline IPS must keep up with line rate; otherwise it will drop legitimate packets or introduce unacceptable latency. Sizing and tuning the inspection engine for the full 10 Gbps plus expected bursts ensures the device does not become a performance bottleneck or a de facto denial of service. This directly supports the goal of maintaining availability while enforcing prevention. It is a fundamental capacity planning requirement for inline IPS on critical high-speed links.

The /proc filesystem exposes process information. /proc/1234/environ contains the environment variables of process 1234 as a null-separated list. Reading this file reveals the exact environment the process was started with, which can help detect injected variables. It is the direct and correct method to inspect a specific process's environment.

Threshold-based correlation on source IP and time window is a standard SIEM technique to distinguish brute-force attempts from isolated user errors. Ten failures in five minutes from one source exceeds normal human error rates and indicates automated guessing, while ignoring scattered single failures that are typical of mistyped passwords.

VLANs logically separate the guest and internal broadcast domains, and an ACL on the router interface enforces policy between them. Because inter-VLAN traffic must be routed, the router is the correct enforcement point. This combination directly prevents guest users from reaching internal file servers while still allowing both groups to reach the internet through controlled paths. It is the standard and effective way to segment a flat network with existing Layer 2 and Layer 3 equipment.

Prompt injection exploits the model's inability to distinguish developer instructions from user input. Validating and sanitizing inputs to detect and neutralize override phrases directly reduces the attack surface by preventing malicious instructions from being interpreted as system-level commands. This targets the root cause—untrusted input being treated as trusted instruction—rather than merely detecting symptoms after data has already been exposed.

CT logs provide an append-only, publicly auditable record of issued certificates. Publishing internal certificates to a CT log allows the security team to monitor for unauthorized issuance; any forged certificate would appear in the log, enabling detection. This is the most effective detective control among the options, as it directly addresses the risk of undetected certificate forgery.

The SC command (sc.exe) can be used to modify a service's security descriptor via the 'sdset' option. This allows an administrator to apply a custom DACL that restricts who can start, stop, or configure the service. This is a direct way to harden service permissions and reduce the attack surface by limiting access to authorized users only.

The hash is calculated using the full path of the executable. This allows the system to store distinct prefetch information for applications sharing the same name but residing in different directories, providing forensic investigators with the exact location where the binary was executed from.

This command uses auditpol to configure the Logon/Logoff category to audit both successful and failed events. It directly addresses the requirement to log all authentication attempts, including failed logons, by setting both success and failure auditing. This is the correct way to enable auditing for the specified category, ensuring compliance with the organization's policy.

Issuing digital certificates is a core function of the Certificate Authority (CA) within a PKI. These certificates bind a public key to a specific entity, allowing other parties to verify that the entity is who they claim to be, which is fundamental to establishing trust online.

The SRM is the kernel-mode component that enforces access control. It validates the user's access token against the DACL on a requested object. It is the definitive authority for authorization decisions within the Windows operating system, ensuring that permissions are strictly followed for all resource access requests.

Implementation Groups categorize safeguards by risk and resource availability. IG1 provides foundational cyber hygiene for all organizations. IG2 adds safeguards for those with moderate risk and more resources. IG3 includes advanced safeguards for high-risk environments. This helps organizations prioritize and measure progress against a relevant subset of controls, making it a practical effectiveness measurement tool.

In IKEv2 with PSK, the authentication exchange involves a hash of the PSK and other values. An attacker who captures the handshake can perform an offline dictionary attack to recover the PSK if it is weak. This is a serious concern because PSKs are often human-chosen and may be susceptible to guessing. Unlike certificate-based authentication, there is no public key infrastructure to provide strong authentication.

The purpose of a honeytoken is to act as a detection mechanism. By creating a resource that serves no business purpose, any interaction with it serves as a clear indicator of malicious intent, allowing security teams to respond immediately to threats that have evaded other detection controls.

Restricting traffic to TLS 1.2 and 1.3 eliminates the usage of deprecated, insecure ciphers and handshake methods. This configuration adheres to current industry best practices and compliance frameworks, effectively closing the window on several classes of protocol downgrade attacks that plague older implementations of the HTTPS stack.

Inter-VLAN access control lists or internal firewalls enforce strict boundaries between separate network segments. Implementing this control ensures that traffic between the human resources VLAN and the finance VLAN is explicitly filtered according to the principle of least privilege.

DHCP Snooping tracks legitimate IP-to-MAC address assignments by monitoring untrusted switch ports. Dynamic ARP Inspection references this verified database to intercept and drop malicious ARP packets, successfully preventing both DHCP spoofing and man-in-the-middle ARP cache poisoning attempts.क्क

Credential Guard uses virtualization-based security to isolate and protect derived domain credentials, such as NTLM hashes and Kerberos tickets, from being extracted by malware. It prevents pass-the-hash attacks by keeping these secrets in a secure container. This directly addresses credential theft and is a correct measure.

SPAN copies frames from selected switch ports or VLANs to a monitoring port, giving passive visibility of east-west traffic without inline interception. This satisfies the constraint of capturing raw packets while production flows continue uninterrupted.

Local enumeration tools like WinPEAS and Seatbelt run from the compromised host and collect patch levels, missing updates, weak service permissions, saved credentials, and misconfigurations that remote scans often miss. Because the tester already has a shell, this approach directly answers the goal of finding local vulnerabilities without needing additional credentials or scanner access.

Threshold-based alerting filters out transient, single-instance failures caused by mistyped passwords or minor sync issues. By requiring multiple failures in a short duration, the system ignores common user errors while still catching automated brute-force attacks, successfully balancing signal fidelity with the need for continuous security monitoring and oversight.

Constrained Language Mode (CLM) in PowerShell limits the access to sensitive .NET types and commands, making it harder for attackers to use the shell for malicious purposes. This restricts the power of the tool, ensuring that attackers cannot easily perform advanced memory-based operations or API calls.

WPA3-SAE replaces the PSK four-way handshake with a Dragonfly-based exchange that provides forward secrecy and resists passive offline dictionary attacks. An eavesdropper cannot capture a handshake and test candidate passphrases offline against it. This directly raises resistance to dictionary attacks, and WPA3-capable hardware can often be enabled through firmware or a controller profile update rather than a full replacement.

Windows Update for Business policies delivered through Group Policy Objects let Active Directory domain administrators centrally enforce cloud-linked update settings across sites, leveraging existing domain infrastructure and computer-scoped policy application rather than relying solely on Intune or MDM channels.

WPA2-Enterprise leverages 802.1X, which requires unique authentication per user, typically via certificates or domain credentials. This approach prevents credential sharing because each session is cryptographically bound to an individual identity, allowing administrators to revoke specific access without impacting the entire wireless network architecture or changing shared passwords.

Allowlisting works by creating a whitelist of authorized applications. Any file not on this list is blocked by the OS or agent. This effectively stops unauthorized software, scripts, and malware from running, providing a much stronger security posture than traditional antivirus, which relies on identifying known bad files.

The Post-Incident Activity phase centers on reviewing the incident to improve future response. A structured meeting with stakeholders captures lessons, identifies gaps in the plan, and assigns improvements. This directly fulfills the phase's purpose of turning experience into actionable changes, making it a correct activity for this scenario.

In Windows ACL evaluation, an explicit Deny ACE is evaluated before any Allow ACE, regardless of whether the Allow comes from group membership or inheritance. Because Alice's user account has a direct Deny on 'Read & execute', that deny overrides the Modify permission granted to her group, preventing her from opening the file. This is a fundamental rule of Windows access control.

WPS is inherently insecure due to design flaws in the PIN exchange process. Disabling it completely eliminates this attack vector, which is a mandatory step for any secure deployment. Failure to disable WPS leaves the network vulnerable to rapid credential recovery through automated brute-force tools.

Network isolation via NAC or EDR containment severs the adversary's access while keeping the host running, so volatile memory and active connections remain available for capture. This limits spread to other production servers and preserves evidence, satisfying both containment and forensic requirements. It is the most balanced strategy for a live compromised host on a shared VLAN.

The find command with -perm -4000 locates files with the setuid bit set, which run with the file owner's privileges, often root. Removing the setuid bit from binaries that do not require it eliminates a common privilege escalation vector while preserving necessary functionality. This is a core hardening action for setuid auditing.

802.1X is a port-based network access control standard that authenticates devices before granting access. With EAP-TLS, the supplicant and authentication server exchange certificates, and the switch acts as the authenticator, relaying credentials to the existing RADIUS server. Until authentication succeeds, only EAPoL traffic is allowed. This meets both requirements: pre-admission authentication and RADIUS integration, and it is the standard method for wired port security in high-security environments.

Homomorphic encryption allows mathematical operations to be performed directly on ciphertext. The result of the operation, when decrypted, matches the result that would have been obtained if the operations were performed on the original plaintext, providing a unique method for keeping data secure while it is being actively processed.

PEAP-MSCHAPv2 is vulnerable to offline dictionary attacks because the captured MSCHAPv2 exchange can be cracked without further interaction. EAP-TLS replaces password-based inner authentication with mutual certificate authentication, so there is no crackable password hash. This directly eliminates the attack vector while preserving WPA2-Enterprise. It is the most targeted mitigation for the described offline cracking scenario.

A deployment ring in Windows Update for Business is a logical grouping of devices that receive updates on a scheduled basis. By placing a subset of devices in a ring, the administrator can validate the upgrade for driver compatibility and other issues before expanding to other rings. This staged approach reduces risk and aligns with the goal of preventing incompatible upgrades from affecting the entire fleet.

Device Guard (now part of Windows Defender Application Control) uses Code Integrity policies to enforce that only trusted, signed kernel-mode drivers and user-mode binaries can execute. It blocks unsigned or malicious drivers from loading, directly preventing rootkit installation. This is the correct choice because it specifically controls driver signing and integrity at the kernel level, meeting the requirement to allow only approved drivers.

The NTUSER.DAT hive is the root of the HKEY_CURRENT_USER registry branch. Examining the file system metadata for this specific file directly reveals the LastWrite time, indicating when the hive was last flushed to disk, which corresponds to the last time the user profile was active.

The Windows Server 2012 domain functional level is the minimum requirement to enable Authentication Policies. This feature allows administrators to restrict which hosts an account can authenticate to, which is a powerful mechanism for limiting the blast radius of a compromised credential within the domain environment.

NetworkPolicy acts as a pod-level firewall, allowing administrators to specify which pods, namespaces, and ports can communicate. By default, pods can reach each other freely, so a compromised container can scan and attack neighbors. Applying restrictive ingress and egress policies limits lateral movement and blocks access to node services, directly containing a breach.

Collision resistance specifically addresses the difficulty of finding any two distinct inputs that map to the same hash value. This prevents attackers from creating a 'doppelganger' file that passes integrity checks designed for a known-good file, which is a key requirement for secure file verification and distribution systems.

Process Explorer is a Sysinternals tool that provides detailed information about running processes, including loaded DLLs, handles, and memory usage. It can show suspicious strings or unsigned modules in process memory, helping detect code injection. This makes it suitable for inspecting process memory for signs of fileless malware. Therefore, it is the correct choice.

Adding statistical noise to the training data ensures that the model learns general patterns rather than memorizing specific, sensitive individual data points. This mathematical approach significantly reduces the accuracy with which an attacker can reconstruct the original training records from model outputs.

AES-256 provides a significant security margin, and XTS is the standard mode designed specifically for block-oriented storage media. It prevents data manipulation attacks and provides high performance when combined with AES-NI hardware acceleration, making it the preferred choice for modern full disk encryption implementations across diverse hardware platforms.

MAC flooding sends frames with many spoofed source MAC addresses, exhausting the switch's CAM table. Once the table is full, the switch cannot map destinations to ports and falls back to flooding unknown unicast frames out every port, allowing the attacker to capture traffic intended for other hosts. The log pattern of many MACs learned on one port is the direct signature of this technique.

A file-following agent such as rsyslog's imfile or a Filebeat harvester tracks an inode and keeps the descriptor open while the file exists. Once 'shred -u' unlinks and overwrites the file, the agent's handle is invalidated and subsequent writes never arrive. Forwarding authentication events off-host in real time with rsyslog or journald to a remote collector removes the local file as a single point of failure, so the attacker cannot suppress events already transmitted.

The pstree command displays running processes as a tree, visually showing parent-child relationships. The -p option includes PIDs, making it easy to correlate with the suspicious process. This helps the analyst quickly identify the ancestry of the process, such as whether it was spawned by init (PID 1) or another parent, which is crucial for understanding how it was launched.

The Incident Response Plan is the primary document that outlines the steps to take during a breach, including legal and regulatory notification requirements. Having this plan in place ensures that legal obligations are met promptly, reducing the risk of non-compliance penalties and ensuring consistent communication with regulatory authorities.

BitLocker encrypts the entire volume, so if the server or its disks are physically stolen or accessed from another OS, the data remains unreadable without the recovery key. This directly addresses the risk of unauthorized physical access, adding a layer that protects data at rest independent of user authentication.

The USBSTOR key in the SYSTEM hive records USB mass storage devices that have been connected to the host, including device identifiers, serial numbers, and friendly names. It is the primary artifact for proving prior USB mass storage connections. It does not track individual file opens, so it addresses the USB portion of the investigation rather than the recent-file portion.

For the browser to accept and enforce HSTS, the header must be received over HTTPS with a certificate that the browser trusts. If the certificate is invalid or self-signed, the browser will not process the HSTS header, and the policy will not be applied. Therefore, a valid HTTPS connection is necessary for HSTS to be effective.

PowerShell Script Block Logging records the full content of code executed by the PowerShell engine. Since fileless malware frequently uses obfuscated PowerShell scripts for execution, this logging mechanism captures the de-obfuscated commands in memory, allowing for detection of malicious activity that never touches the disk.

Audit watches are attached to the inode of the watched file. Tools like vipw and vigr edit a temporary copy and then rename it over the original, creating a new inode. The watch on the old inode no longer applies, so the modification is not logged. This is a well-known limitation that requires watching the directory or using a different audit key strategy.

The top command provides an interactive, live dashboard of system activity. It updates at regular intervals, showing the most resource-intensive processes. This allows administrators to sort by CPU usage, identify abnormal spikes, and manage processes, which is essential for diagnosing performance issues or detecting malicious background tasks.

Path MTU discovery depends on ICMP Destination Unreachable with the fragmentation-needed code to tell the sender to reduce packet size. If that ICMP is filtered, the sender never learns the smaller MTU and keeps emitting oversized packets that are silently dropped. This exactly produces the pattern where small packets pass and large ones fail, making it a genuine cause in this scenario.

Containment aims to limit the scope and impact of an incident. Isolating the server prevents further lateral movement and stops the attacker from exfiltrating data or causing more damage. This is a classic containment action, as it separates the affected system from the rest of the network while allowing forensic analysis to continue.

In SaaS, the provider manages the application, runtime, and infrastructure, but the customer remains responsible for who can access the application and what they can do. Identity lifecycle, authentication strength, and authorization assignments are customer-controlled and are a primary source of SaaS breaches. The agency must govern these to protect criminal justice information.

Audit Directory Service Changes logs events when objects in Active Directory are modified, including the old and new values of changed attributes. This policy is specifically designed to track changes to directory objects, providing the detailed information required for forensic investigations of user account modifications.

The Secure flag instructs the browser to restrict the cookie transmission to encrypted (HTTPS) connections only. This is the primary mechanism for ensuring that sensitive session identifiers are not exposed in plaintext during network transit, providing a necessary layer of protection against sniffing and interception of data.

Application-aware filtering with DPI examines packet payloads beyond headers to identify applications regardless of port or protocol. It can detect tunneling and evasive techniques by analyzing behavioral patterns and signatures. This directly addresses the requirement to enforce policies based on application identity and to handle non-standard ports and HTTP tunneling.

Control 2 requires maintaining an up-to-date inventory of all software installed on enterprise assets. This ensures that unauthorized software (shadow IT) can be detected and managed. By enforcing this control, security teams gain the visibility needed to authorize or remove applications, closing the gap described in the scenario.

A user-assigned identity is a standalone Azure resource. This allows it to be assigned to multiple Azure resources (like VMs or App Services) and managed independently of the lifecycle of those resources, providing better scalability and centralized control over permissions in complex, multi-service cloud deployments.

Manual testing is essential for logic flaws, broken authentication, and session management issues that automated scanners often miss. By exercising login, logout, password reset, and session fixation scenarios by hand, the tester uncovers vulnerabilities that require contextual understanding, which complements the automated scan and increases overall assessment quality.

The ss command with these flags displays all TCP and UDP listening ports, along with the numeric service port and the process ID (PID) that opened the port. This level of detail is vital for security professionals to map open network sockets back to specific running applications.

A stateful firewall maintains a connection table and permits return traffic for sessions that were initiated according to policy. Many stateful firewalls also perform network address translation at the edge. The scenario describes stateful connection tracking and NAT but not deep application inspection, which is exactly the core behavior of a traditional stateful firewall. This device type fits the placement and described functions precisely.

VLAN segmentation with inter-VLAN access control lists restricts traffic between network segments, so a compromised workstation in one VLAN cannot freely reach hosts in other VLANs. This directly limits lateral movement and reduces the blast radius, which is a core defense-in-depth principle. It adds an internal boundary that complements perimeter controls.

A Switched Port Analyzer (SPAN) session copies frames from selected source ports or VLANs to a destination port, allowing the sensor to passively observe unicast traffic it would otherwise never receive. This is the standard, vendor-supported way to gain visibility on a switched segment without disrupting forwarding, and it satisfies the requirement that the sensor see traffic not addressed to it.

Piping a remote script directly into a shell executes whatever the endpoint returns at build time, with no hash or signature check. If the endpoint or DNS is compromised, malicious code becomes part of a legitimate image layer, and later vulnerability scanning may not flag novel or obfuscated payloads, making this the primary supply chain risk.

USBSTOR records every USB mass-storage device that has been connected, storing the device descriptor, vendor, product, and a unique serial number in the subkey name. Correlating the serial in USBSTOR with setupapi.dev.log entries confirms the specific device even when log entries appear missing, because USBSTOR persists after disconnection and can survive log rotation or selective deletion. This directly addresses the insider-threat scenario.

Salting ensures that two users with the same password have different hashes stored in the database. This prevents attackers from using precomputed rainbow tables to crack multiple accounts simultaneously and forces them to perform a unique attack against each user, drastically increasing the time required for successful password recovery.

CTR turns a block cipher into a stream cipher by encrypting sequential counter values, so any block can be decrypted independently once the correct counter value is known. This allows parallel processing and random access, which suits a low-CPU tape appliance and a multi-gigabyte archive. The engineer must still ensure counter values are never reused with the same key, but CTR meets the independent-chunk requirement without the chaining dependency of CBC.