GIAC Security Essentials (GSEC) — Questions 76–150

Argon2id is purpose-built for password storage and its memory-hard design sharply limits GPU parallelism, because each guess requires substantial memory that GPUs cannot multiply cheaply. Tuned time and memory costs plus unique per-user salts make offline cracking of a stolen database far more expensive than with fast general-purpose hashes.

EAP-TLS authenticates both the supplicant and the authentication server with X.509 certificates and completes a TLS tunnel whose keys never expose a shared password. An attacker capturing the four-way handshake only obtains the ANonce, SNonce, and MIC values tied to that session, which cannot be replayed to derive the PMK for a new association, so impersonation fails without the client's private key.

The JSON policy clearly specifies an action of 'Deny' for any file path matching the AppData directory pattern. Because the policy is in 'Enforce' mode, the security agent will block any attempt to execute a binary from this location, effectively stopping the user from running their application.

A SACL defines which users or groups and which access types (e.g., Write, Delete) should be audited. You must set a SACL on each file or folder you want to monitor. This is done via the file's Properties -> Security -> Advanced -> Auditing tab. Without a SACL, no auditing occurs for that object, even if the audit policy is enabled.

Stateful inspection maintains a session table that tracks the state of each connection. When an outbound connection is initiated, the firewall creates an entry, and return traffic matching that session is automatically allowed. If session tracking is disabled or the table is full, return packets may be dropped. This feature is essential for allowing return traffic without explicit inbound rules.

A dedicated vMotion VMkernel interface placed on a separate VLAN segments migration traffic away from guest data paths, and vMotion encryption protects the transferred memory contents even if the underlying network is observed. This directly mitigates both sniffing and tampering by a compromised guest because the migration stream never shares the guest-facing segment and is cryptographically protected.

FIM computes cryptographic hashes of critical files and compares them against a known-good baseline, so any unauthorized modification of EHR database records triggers an alert. This adds a detective control at the data layer, complementing existing preventive network and host controls. It directly addresses the need for near-real-time detection of record tampering without disrupting clinical workflows.

Signing a hash of the message rather than the raw message is essential for performance and security. A collision-resistant hash ensures that it is infeasible to find two different messages with the same hash, which would allow signature forgery. This practice is fundamental to achieving integrity and non-repudiation in digital signatures.

ProfileList is the authoritative source for locating where a user's profile resides on the disk. For an investigator, this is essential to verify account existence and identify the correct directory path for further analysis of user-specific artifacts that might contain evidence of attacker activity.

Gatekeeper is the security feature that checks if an application is signed by an identified developer and notarized by Apple. If an application fails these checks, Gatekeeper prevents it from executing to ensure that the software has not been altered or created by an untrusted entity.

Deep packet inspection that understands Modbus/TCP can parse the function code field and enforce an allowlist of approved read operations while dropping others, which matches the requirement to block unauthorized function codes. Because it is purpose-built for OT protocols, it can do this without the latency and compatibility problems a general-purpose proxy would introduce.

This enforces the required direction: the trusted monitoring platform originates the session, and the stateful firewall builds a session table entry so only return traffic for that flow is allowed back. Contractors cannot initiate inbound connections to the server VLAN, and monitoring still works because the firewall tracks the established session rather than trusting source addresses.

OpenVAS, now delivered through Greenbone Vulnerability Management, is an open-source vulnerability scanner with a continuously updated feed and support for both authenticated and unauthenticated scans. It has no per-host licensing limit, making it suitable for scanning a 254-host subnet at no cost while still meeting the maintenance and capability requirements.

fdesetup status reports whether FileVault is On or Off and, when in progress, the percentage of encryption completed. It directly answers the compliance question about full disk encryption being active on the MacBook, making it the correct tool for verifying FileVault state.

The listed advanced permissions (List folder/read data, Read attributes, Read extended attributes, Read permissions, Synchronize) are exactly those that comprise the Read & execute basic permission (plus Read for files). This explains why the contractor can read but not write. The basic permission is a shorthand for this set of advanced permissions, and it is commonly used to grant read-only access to folders and files.

Mounting the Docker socket (/var/run/docker.sock) into a container grants that container control over the Docker daemon, which typically runs as root. An attacker could use the Docker API to create privileged containers, mount host filesystems, or escape to the host, leading to full compromise.

Enforce password history determines how many unique new passwords must be used before an old password can be reused. Setting it to 24 prevents reuse of the last 24 passwords, directly meeting the requirement. This is the correct setting because it specifically tracks and blocks previous password hashes, ensuring users cannot cycle back to recent passwords.

Control 4 specifically requires the establishment and maintenance of secure configurations for all enterprise assets. It ensures that systems are deployed with hardened settings, unnecessary ports are closed, and only authorized software is permitted. This effectively mitigates the risk of exploitation through default settings or unauthorized application execution.

Central Access Policies are the core component of Dynamic Access Control. They allow administrators to define resource authorization policies centrally in Active Directory and apply them to files and folders using resource properties, effectively enforcing access based on user attributes like department or job title globally.

Event ID 5156 is logged only when the Filtering Platform Connection subcategory is audited. By default it is not enabled, so the query returns nothing. Enabling this subcategory via Advanced Audit Policy Configuration and provisioning sufficient Security log capacity allows the responder to capture allowed and blocked connection events with process, user, and port details needed to trace exfiltration.

Firewall logs document allowed and denied traffic at network boundaries. They are essential for identifying reconnaissance, data exfiltration, and communication with known malicious command-and-control servers. Analyzing these logs helps security teams understand how traffic flows through the perimeter and identify potential entry points for attackers or internal threats.

This rule set allows inbound HTTPS to the public server and explicitly blocks the server from initiating connections to internal addresses. Permitting established return traffic lets responses to external clients flow back without opening new inbound sessions. It enforces the one-way trust boundary that a screened subnet is meant to provide while keeping the public service reachable.

The display lists 'Success and Failure' under the credential validation subcategory. This confirms that the security policy is set to log every authentication event, allowing for full visibility into legitimate login patterns and potential unauthorized access attempts targeting user credentials.

Microsoft Defender Antivirus is the built-in antivirus component of Windows that provides real-time scanning, cloud-delivered protection, and automatic signature updates through Windows Update. It scans files, email attachments, and downloads, and it integrates with Windows Security. It requires no additional purchase and is enabled by default on modern Windows versions, directly matching the consultant's recommendation for a single built-in feature.

Storing files outside the web root prevents direct URL access, and a validating handler ensures only safe file types are served. This combination stops the server from executing the uploaded file, because the file is never placed in a location where the web server would interpret it as code. It directly mitigates the vulnerability by removing the execution path and enforcing content validation.

Hypervisor introspection allows the hypervisor to monitor and analyze the memory and state of guest VMs from outside the guest, enabling detection of malicious activity such as escape attempts. It operates at the hypervisor layer, providing visibility that traditional in-guest agents cannot achieve, and is specifically designed to identify anomalies like unauthorized memory access from a guest to the hypervisor.

Increasing RSA key size to 2048 bits and replacing SHA-1 with SHA-256 aligns with current standards such as NIST SP 800-57 and CA/Browser Forum requirements. This maintains the RSA algorithm family while addressing vulnerabilities in both key length and hash function. It provides a stronger security margin without changing the underlying cryptographic approach.

NetFlow records include byte and packet counts for each flow, providing a direct measurement of data volume for outbound connections. They are generated by network devices and can be correlated with firewall logs by source/destination IP, port, and timestamp. This allows the analyst to estimate exfiltration volume accurately. NetFlow is widely supported and can be exported to the SIEM, making it the most reliable source for volume data in this scenario.

Event ID 4625 is the definitive log entry for a failed logon attempt in the Windows Security event log. It contains valuable metadata such as the username, source IP address, and logon type, which are necessary for identifying the origin and target of a brute-force attack.

Event ID 7045 in the System log is written by the Service Control Manager when a new service is installed, and it records the service name, image path, service type, and start type. This directly answers whether a new service was created for persistence. It is generated by default on modern Windows systems, requires no pre-enabled auditing, and provides the exact evidence needed to confirm service installation after a drive-by exploit.

Deleting a file requires the write permission on the parent directory because it involves removing a directory entry. The 'r-x' permissions for others demonstrate that the user does not have write access, which is the mandatory requirement for modifying the contents of a directory, including file deletion.

Advanced Audit Policy Configuration provides granular control over object access auditing. Enabling the Audit File System subcategory allows you to log file read/write events only when a system access control list (SACL) is set on the target folder. This minimizes noise by targeting the specific subcategory rather than the broad legacy policy, and it is the necessary first step before configuring the SACL on the folder itself.

Enabling Success and Failure auditing for the Account Management subcategory captures events such as user account creation (Event ID 4720) and group membership changes (Event ID 4728/4732). This directly addresses the scenario by logging both successful and failed attempts to create or modify local accounts, which is necessary to detect an attacker adding a local administrator. It also provides a balance of visibility without enabling entire categories that would generate excessive noise.

If object access auditing was enabled, the Security event log records file access events, including the account name, the object path, and the share accessed. Because the log is stored in C:\Windows\System32\winevt\Logs and is system-scoped, it survives deletion of the user profile and account. It is the most likely remaining source for the user's recent file opens from a network share.

The rapid cadence of failed attempts from a single source strongly suggests an automated brute-force attack. Investigating the source IP allows the analyst to verify if the machine is a known asset or an unauthorized intruder, and blocking it is the correct containment strategy to protect the server.

NTFS stores two sets of timestamps: $STANDARD_INFORMATION, which many APIs update, and $FILE_NAME, which is typically updated only on rename or certain metadata changes. Tools and some APIs can modify $STANDARD_INFORMATION times without touching $FILE_NAME, producing exactly this discrepancy. It is a well-documented artifact and a common timestomping indicator, so this explanation fits the evidence best.

This awk command parses /etc/shadow using colon as the field separator and checks if the second field (the password hash) is empty. If so, it prints the username. This directly identifies accounts with empty passwords, which is a critical security risk. It is a precise and efficient way to audit for this specific misconfiguration.

Microsegmentation applies granular security policy to individual workloads or groups, often using an overlay that decouples policy from physical topology. Because enforcement is tied to workload identity and tags rather than subnet boundaries, an attacker who compromises one workload cannot freely reach others. This directly satisfies the requirement to restrict lateral movement and enforce identity-based policy, making it a correct choice for the scenario.

This definition aligns perfectly with the Principle of Least Privilege. By restricting access to only what is strictly necessary, an organization significantly reduces the impact of accidental mistakes, insider threats, and external attacks, as an attacker will find themselves limited by the restricted permissions of the compromised account.

DMARC specifically enables domain owners to protect their domain from being used for email spoofing. It provides a feedback mechanism and policy enforcement that tells receiving mail servers how to reject or quarantine emails that do not pass SPF or DKIM authentication, directly preventing domain impersonation and phishing.

Event ID 4624 is logged on the local computer when a logon session is created. It includes the Logon Type, which indicates how the logon occurred. For interactive logons, the Logon Type is 2. By filtering 4624 events with Logon Type 2 on the domain controller, you can identify which accounts were used for interactive logons, directly answering the scenario.

Archiving older logs to cheaper secondary storage is a standard cost-effective approach for long-term retention. The SIEM keeps recent, frequently queried data on expensive primary storage, while older logs are moved to a lower-cost tier. This meets the one-year retention requirement without overprovisioning primary storage. It also allows retrieval for investigations or compliance audits, though search performance on archived data may be slower.

gMSAs manage complex, long, and randomly generated passwords that are automatically rotated by the Active Directory Key Distribution Service. This eliminates the risk associated with human-managed static passwords and prevents service interruptions during rotation, ensuring that credentials are never stale or vulnerable to offline cracking attempts.

Rainbow tables are pre-computed tables of hashes used to crack passwords quickly. By using a unique salt for every user, the set of possible hashes becomes effectively infinite for any given password, rendering rainbow tables useless because they cannot account for the random salt value injected into the hash function.

An evil twin impersonates a legitimate AP by cloning its SSID and BSSID, and a stronger signal persuades clients to associate. In WPA2/WPA3-Enterprise, the rogue cannot complete the TLS handshake without a certificate the client trusts, so enforcing server certificate validation in the supplicant stops the association. This directly defeats the impersonation rather than merely detecting it after the fact.

Regular backups that are kept offline and offsite ensure that even if ransomware encrypts the network drive, a clean copy of the data exists and can be restored. This is the most reliable way to recover from ransomware without paying. It directly addresses the need to restore files quickly and effectively.

Gatekeeper is the macOS feature that verifies the authenticity and integrity of applications downloaded from the internet. It checks whether the app is notarized by Apple and signed with a valid Developer ID. If the app cannot be verified, Gatekeeper blocks it from launching, which matches the scenario. This is the primary defense against malware disguised as legitimate software.

SetupDiag is the designated Microsoft utility that scans setup log files, extracts error codes, and details the exact conditions that caused a Windows feature update to fail and rollback. This tool dramatically accelerates troubleshooting by pointing directly to offending drivers or software.

Restricting access to specific IAM roles ensures that only authorized entities can interact with the bucket. Requiring Secure Transport (HTTPS) ensures that data in transit is encrypted, protecting against interception. This combination adheres to the principle of least privilege and robust data protection standards.

RADIUS centralizes the decision of which authentication method each account must satisfy. Contractors are mapped to token-based policies while administrators retain password authentication, and because sshd still calls PAM, the existing SSH clients need no changes. This satisfies every constraint in the scenario without duplicating credentials locally.

A CAPTCHA challenge presented after a threshold of failures forces automated tools to solve a human-verification task, breaking the economics of credential stuffing. Legitimate users who mistype a password a few times still pass through normally, so the customer experience is largely preserved. This is a targeted application-layer control.

If a workstation is compromised, segmentation limits the attacker's ability to scan or connect to other network segments. By placing servers in a separate VLAN from end-user devices, the organization forces the attacker to find another way to move through the network, adding friction to the attack.

The principle of least privilege states that users should be granted only the minimum access rights required to perform their job functions. This directly matches the requirement to grant minimum permissions necessary. Applying this principle reduces the attack surface and limits potential damage from compromised accounts, making it a core component of the desired access control system.

Heterogeneous controls prevent single points of failure. If all layers used the same technology, a single zero-day exploit could potentially compromise every layer simultaneously. Diversity ensures that an attacker must possess multiple, distinct exploits to traverse the various security layers, drastically increasing the difficulty for the adversary.

The -sT option performs a TCP connect scan using the operating system's connect() system call, which does not require raw socket privileges. This makes it ideal when running Nmap as a non-root user or when the analyst lacks the ability to send raw packets. It completes the full TCP three-way handshake against each target port.

RBAC bindings define exactly which API verbs and resources a service account may access. Replacing broad permissions with a least-privilege Role ensures that even if the container is compromised, the token cannot list secrets or perform privileged operations. This directly limits the blast radius against the API server, matching the team's objective.

The Modify permission includes Read & execute, Write, and Delete, but does not include Change permissions or Take ownership. This allows SalesTeam members to read and write files without the ability to alter ACLs or ownership. It is the appropriate standard permission for collaborative file access where users need to edit content but not manage security.

Web browsers rely on the local certificate store to validate the identity of web servers. If the issuing CA's root certificate is not present in the user's trusted root certification authorities store, the browser will signal that the site's identity cannot be verified, resulting in a security warning.

No preventive control is 100% effective. Detective controls like IDS, log analysis, and file integrity monitoring provide the necessary visibility to identify when a preventive control has failed. This allows the security team to act quickly, minimizing the damage caused by an attacker who has successfully gained unauthorized access.

Setting runAsUser: 0 explicitly runs the container process as the root user (UID 0). If an attacker compromises the container, they gain root privileges within the container, which can be leveraged to escape to the host or access sensitive resources, especially if combined with other misconfigurations like hostPath mounts.

De-authentication attacks exploit the lack of management frame integrity in older 802.11 standards. By spoofing the AP's address, the attacker forces clients to drop their connection. This is a common method for disrupting service or preparing a target for an Evil Twin or packet interception attack.

Password-protecting the GRUB 2 menu with a superuser entry prevents interactive editing of kernel parameters at boot, and restricting permissions on grub.cfg blocks unprivileged reading of the bootloader configuration. Together these satisfy the stated hardening policy, because only users who supply the GRUB password can modify boot entries, and other local users cannot inspect the configuration file.

Kismet places the adapter in monitor mode, which captures all 802.11 frames on the channel without associating. Beacons and probe responses reveal BSSIDs, SSIDs, channels, and encryption settings, while hidden networks appear through probe responses and data frames. Because no association occurs, the assessor stays passive and avoids altering or alerting the target network.

Name Constraints enforce strict boundaries on subordinate CAs by defining exact permitted and excluded domain namespaces. If a sub-CA attempts to issue a certificate outside these boundaries, relying parties will immediately reject it as invalid.

Credential stuffing uses lists of username and password pairs obtained from data breaches on other sites. Attackers assume users reuse credentials across services. The scenario explicitly mentions a list of previously breached combinations, which is the hallmark of credential stuffing. Requiring a second factor (like a one-time code) prevents unauthorized access even if the password is correct, effectively mitigating this attack.

A deployment ring with a feature update deferral of 0 days means the pilot group will receive feature updates as soon as they are released, before other rings with longer deferrals. This allows early testing and identification of issues. It is the standard approach for pilot deployments in Windows Update for Business.

DAC uses claims-based identity and resource properties to enforce access. It allows for complex rules, such as 'only managers in the Finance department can access files marked as sensitive,' which is far more efficient than managing membership in dozens of static security groups across the domain.

For an inline IPS on a high-speed clinical link, the device must handle 10 Gbps of traffic without adding latency that affects real-time monitoring. A hardware bypass or fail-to-wire capability ensures that if the IPS fails or loses power, traffic continues to flow, preserving patient safety. This combination of performance and availability is the primary deployment consideration for this scenario.

The /etc/security/pwquality.conf file is used by the pam_pwquality PAM module to enforce password complexity requirements such as minimum length (minlen), required character classes (ucredit, lcredit, dcredit, ocredit), and password history via the remember parameter (often set in PAM configuration but also influenced by pwquality). This is the correct location to define the specified password policy for local accounts on modern Linux distributions.

Limiting user permissions ensures that if a workstation is compromised, the attacker can only encrypt the files that user has permission to modify. This prevents the ransomware from spreading to critical shared network drives or sensitive directories, effectively containing the potential impact of the infection to a single user's profile.

Pre-Boot Authentication forces the user to input a secret before the decryption keys are loaded into RAM. This ensures that the data is truly protected against cold-boot attacks and unauthorized access if the machine is powered off, as the drive remains encrypted until that specific challenge is successfully met.

802.1X with dynamic VLAN assignment groups endpoints by role, such as employee, contractor, or guest, and can place unpatched devices into a remediation VLAN. This limits lateral spread because an infected endpoint in one role segment cannot directly reach endpoints in another segment. It is a foundational control for defensible network architecture and directly addresses same-VLAN spread by making VLANs smaller and identity-driven.

Object Inherit (OI) ensures files inherit the ACE, and Container Inherit (CI) ensures subfolders inherit the ACE. These flags are critical for administrative efficiency, as they automatically propagate security settings to all child objects, ensuring consistent application of the least privilege principle throughout the file hierarchy.

Digital signatures provide a verifiable link between the image and the build process. By using a private key to sign the image manifest, the organization ensures that any subsequent modifications to the image data will cause the signature validation check to fail upon deployment.

IG1 is designed for small organizations with limited resources and low data sensitivity. It consists of essential cyber hygiene safeguards that provide a baseline defense against general, non-targeted attacks. Since the startup handles only public data and has no compliance mandates, IG1 is the proportionate starting point.