GIAC Security Essentials (GSEC) — Questions 151–225

CIS Control 3 explicitly requires encryption of data at rest on end-user devices and servers. Full-disk encryption protects data if a device is lost or stolen. This directly addresses the safeguard for data at rest, making it the correct action.

Notarization uses automated tools to scan applications for known malware and verify that they are properly signed by a verified Apple Developer account. This ensures that users are protected from installing malicious software, acting as a crucial pre-execution security check for all macOS applications.

The router processes the ACL in a top-down fashion. The first rule denies all traffic to 10.0.5.5 on port 80. Since the packet matches this criteria, the evaluation stops, and the router silently discards the packet. The permit rule located on the second line is never reached.

These two tools together at the host level create a layer of defense that operates independently of network-wide controls. The host firewall limits incoming and outgoing traffic, while EDR provides continuous monitoring and threat prevention for local processes, effectively creating a defense in depth posture on the machine.

This strategy combines multiple weak indicators (volume, destination reputation, port) and behavioral baselining to increase confidence. Exfiltration often involves transfers to unknown or low-reputation IPs on non-standard ports, and volume that is anomalous for that specific host. Correlating these factors reduces false positives and catches stealthy exfiltration that avoids simple thresholds.

CIS Control 1 begins with establishing and maintaining an inventory of enterprise assets. The foundational step is to define the scope and create a policy that specifies what assets are in scope, who owns them, and how the inventory will be maintained. This ensures that subsequent technical steps, like discovery and tracking, are aligned with business requirements and have clear accountability.

802.1X port-based authentication requires every connecting client to provide valid credentials to an authentication server before the switch port transitions to an active state. This robust mechanism prevents unauthorized physical devices from accessing the internal network environment.

An HSM is a dedicated hardware device that generates, stores, and uses cryptographic keys within a tamper-resistant boundary. Private keys never leave the HSM in plaintext, so the operating system cannot access them. HSMs support high-performance TLS acceleration, making them suitable for high transaction volumes. This meets all requirements: key isolation and performance.

This policy, when enabled, prevents the device from connecting to Windows Update or Windows Update for Business servers, effectively blocking updates. It can override Windows Update for Business settings by preventing the device from reaching the update service. If this policy is set, the device will not receive feature updates even if Windows Update for Business policies are correctly applied. This is a common cause of update failure in managed environments.

Dynamic ARP Inspection intercepts ARP packets on untrusted ports and compares the sender IP and MAC against the DHCP snooping binding database. A forged reply from a MAC that does not own the gateway address is dropped before it reaches the workstation, so the victim never updates its ARP cache with the attacker's address. This directly targets the gratuitous or unsolicited ARP reply used in the on-path attack.

A man-in-the-middle attack can intercept the authentication session and relay the one-time code in real time. If the attacker positions themselves between the user and the VPN, they can capture the password and the token code as the user submits them, then use them to authenticate before the code expires. This allows bypassing the hardware token requirement without possessing the physical token.

This is the correct command-line utility used to query the system's current advanced audit policy. It outputs the status of all audited categories, allowing administrators to confirm that required auditing features are active across the entire system for comprehensive security coverage.

EAP-TTLS (Extensible Authentication Protocol - Tunneled Transport Layer Security) establishes a TLS tunnel and then authenticates the client using various methods inside that tunnel. This ensures credentials are never sent in cleartext. It is commonly used in VPN and Wi-Fi authentication. The scenario requires encapsulating authentication within a TLS tunnel, which EAP-TTLS does by design, making it the correct choice.

Constrained Language Mode restricts PowerShell to a limited set of language features and blocks access to arbitrary .NET types and COM objects. This significantly hinders attackers who rely on PowerShell for fileless malware and post-exploitation. Enforcing it for all users is a valid hardening step that reduces the attack surface while still allowing many administrative scripts to run, so it is an appropriate measure.

Slowloris works by opening many connections and sending headers very slowly, never finishing the request. Since the server keeps these connections open while waiting for the full request, it eventually reaches its maximum connection limit, preventing any new legitimate users from connecting to the application.

Passive IDS sensors monitor mirrored traffic without interfering with packet delivery. Upon detecting malicious indicators, they record the event to local logs and transmit alerts to centralized management systems and SIEM platforms for analyst review.

Physical separation ensures that even if an attacker completely compromises the production data plane, they cannot reach the management plane interfaces because there is no direct network path between the two distinct environments, protecting critical device controls.

This command filters services where the StartType is 'Automatic' and the Status is not 'Running'. It directly returns the list of automatic services that are stopped or in another non-running state. The Where-Object cmdlet evaluates each service object, and the condition uses -and to combine both criteria. This is the most straightforward and accurate way to achieve the goal.

NIDS sensors on internal segments monitor east-west traffic for malicious patterns, such as exploit attempts and unusual lateral movement. This directly addresses the gap that allowed attackers to move internally after initial compromise. It adds a detective layer inside the network, complementing perimeter defenses and endpoint controls.

dm-crypt is a Linux kernel subsystem that provides transparent disk encryption, and LUKS (Linux Unified Key Setup) is a standard format for storing key material. Together, they allow encrypting a block device with a passphrase-protected key. LUKS manages multiple passphrases and stores metadata in the device header. This is the standard tool for full disk encryption on Linux.

Disabling macros by default and allowing only signed macros from trusted publishers directly prevents the execution of malicious macros, which was the initial infection vector. This is a technical control that enforces a secure configuration and is highly effective because it blocks the attack technique regardless of user action. It aligns with the principle of least functionality and is a recommended security baseline.

The /System directory contains core macOS components that are essential for system stability and security. SIP explicitly prevents the root user from writing to or modifying files in this path, ensuring that core binaries and libraries remain untampered throughout the lifecycle of the operating system.

Network isolation successfully severs the communication channel between the malware and the attacker's command-and-control server. This containment step halts data exfiltration and remote command execution while leaving the host powered on, allowing for the secure collection of volatile memory and disk images for post-incident forensic investigation.

Confidential computing extensions like AMD SEV-ES and Intel TDX encrypt guest memory in hardware so the hypervisor and other VMs cannot read it. Enabling these for the affected VM would prevent the compromised guest from reading memory belonging to a different VM, directly mitigating the cross-VM memory disclosure described.

A phased approach separates live-host discovery from service enumeration, letting the tester narrow the target set and apply conservative timing and port scope. Version detection with controlled timing reduces the chance of overwhelming fragile services, directly honoring the no-denial-of-service constraint. Documenting results before exploitation supports repeatable planning and keeps later phases tied to validated findings rather than assumptions.

Application whitelisting explicitly restricts execution to only approved binaries, scripts, and installers. By implementing a default-deny policy, it ensures that any unauthorized or malicious software—regardless of whether it is known to security vendors—will be blocked from executing on the host, providing a robust security posture.

The HttpOnly attribute prevents client-side scripts from accessing the cookie through document.cookie, so even a successful reflected script injection cannot read and exfiltrate the session cookie. This directly neutralizes the described theft technique while leaving the reflection bug in place. It is a targeted, server-side cookie attribute that requires no changes to input handling and is the most direct mitigation for script-based session cookie theft.

nslookup queries DNS servers directly and reports the resolved address or an error, which quickly confirms whether the configured resolver can resolve the internal hostname. Because the application works by IP, the failure is isolated to name resolution, and this command tests exactly that path. It is available on Windows, Linux, and macOS and is the appropriate first diagnostic step in this scenario.

WDAC supports hash rules, which allow executables based on their unique file hash. This is ideal for unsigned applications that need to be whitelisted. The hash ensures that only that exact file is allowed, and any modification changes the hash, preventing tampering. This approach maintains a strong security posture while permitting the necessary application.

Dynamic trunking protocol allows switches to automatically negotiate trunk links with connected devices. Disabling this feature on user-facing access ports prevents malicious actors from injecting crafted DTP frames to force a port into a trunking state and bypass VLAN boundaries.

The log displays an XSS payload injected into a form field, which the framework correctly blocked. This activity represents an active probe by an attacker. It must move to the Identification phase to determine the extent of the scanning or exploitation attempts being conducted against the web application.

Safeguard 17.1 explicitly requires establishing and maintaining a documented incident response plan. This plan must define roles, responsibilities, and communication procedures. It is the cornerstone of CIS Control 17. A documented plan ensures that all stakeholders know their duties during an incident, facilitating a coordinated and effective response. This is the best demonstration of a formal process.

ARP cache poisoning involves sending forged ARP replies to associate an attacker's MAC address with a legitimate IP, such as the default gateway. This allows the attacker to intercept or redirect traffic. In this scenario, the unsolicited replies with a mismatched MAC for the gateway IP are a classic indicator of ARP spoofing, enabling man-in-the-middle or denial-of-service conditions on the LAN.

AES-256 in GCM mode offers high-speed, symmetric encryption that ensures confidentiality while simultaneously providing integrity through an authentication tag. This approach satisfies the dual requirements of reversibility for authorized users and protection against data tampering, which is the gold standard for protecting sensitive database records in modern systems.

WPA3-SAE uses a Dragonfly handshake that provides forward secrecy and resists offline dictionary attacks. Even if an attacker captures the handshake, they cannot perform an offline brute-force because the exchange does not reveal a password-derived hash that can be tested without interacting with the AP. This is a key improvement over WPA2-PSK, which is vulnerable to offline cracking.

This policy blocks unsigned macros for all users while permitting finance's signed macros, directly addressing the infection vector with minimal business impact. Trusted publisher certificates let finance macros run without prompts, and all other unsigned macros are silently blocked. This is the standard Group Policy control for exactly this scenario and does not require third-party tooling or network changes, making it the correct first step.

The /etc/crontab file and the /etc/cron.* directories contain system-wide scheduled tasks that run automatically at specified intervals or at boot. Attackers commonly add entries here to re-establish access after a reboot. Reviewing these locations is a primary step in identifying persistence via scheduled tasks. Other cron locations such as user crontabs also matter, but the system-wide files are the first place to check for reboot-persistent jobs.

When SIP status is reported as enabled, the kernel is protected from unsigned extensions and unauthorized modifications. This is the intended behavior for a secure macOS deployment, ensuring that only trusted components can execute at the lowest levels of the operating system, thereby mitigating risks from malicious drivers.

DNS tunneling encodes arbitrary payloads into query names and response records, using the resolver as a transport to an attacker-controlled authoritative server. Long, high-entropy subdomain labels and a high volume of queries to one domain are classic indicators. Because DNS is rarely blocked, this technique lets a compromised host exfiltrate data and receive commands while blending into normal resolution traffic.

A TLS-based portal authenticates the server with a certificate the client validates, and multi-factor authentication protects against stolen passwords. HSTS forces browsers to use HTTPS and prevents downgrade or SSL-stripping attacks. Because the client only needs to trust the server certificate and complete MFA, no client certificate is required on the personal device, satisfying all stated constraints.

Configuring port security with violation shutdown instructs the switch to disable the interface immediately upon detecting more unique MAC addresses than permitted. This robust defense prevents unauthorized hardware from maintaining connectivity to the access network.

Centralizing logs is crucial because local logs can be cleared by an attacker to hide their tracks. A SIEM ensures that logs are stored securely off-host, allowing for correlation and analysis that would be impossible if limited only to local disk space.

Event ID 4663 is generated when an object (like a file) is accessed, provided object access auditing is enabled. The SubjectUserName field identifies the account that attempted the access. By filtering for the file server's object name and the timestamp, the analyst can pinpoint the user. This event is specifically designed for file access auditing, making it the most direct source for this scenario.

Event ID 7045 indicates a new service was installed. Attackers often create services to achieve persistence, as services can be configured to start automatically at boot and run with high privileges. A binary in a user's temp folder is a red flag because legitimate services rarely reside there. This suggests the service was installed by an attacker or malicious software. Investigating the binary, its hash, and the installing user is critical. This option correctly identifies the risk of persistence, which is a common tactic in cyber attacks.

GPMC provides the interface to define and deploy Group Policy Objects. These objects allow administrators to centrally configure service security, startup behaviors, and account permissions across the entire Active Directory domain, ensuring a uniform and auditable security baseline for all managed Windows services and host systems.

Unique passwords ensure that even if one account's credentials are breached in a data leak, the attacker cannot use those same credentials to access other platforms. This containment strategy isolates the impact of a breach and prevents the automated success typically associated with large-scale credential stuffing campaigns against modern web services.

This isolates the CDE at Layer 2 and enforces a policy enforcement point at Layer 3/4, which is the standard defensible segmentation for PCI DSS. A stateful firewall provides explicit allow rules, logging, and the ability to prove that no unauthorized traffic can reach cardholder systems from corporate desktops.

Kata Containers launches each pod in a lightweight VM with its own guest kernel, so container workloads do not share the host kernel. This provides hardware-virtualization-based isolation that satisfies the requirement. A kernel exploit in the guest does not automatically compromise the host, making Kata the correct choice for stronger isolation.

The analyst is capturing volatile data such as network connections, processes, and kernel modules while the system is live, before it changes or is lost. This directly follows the order of volatility principle, which prioritizes the most perishable evidence first. Running the script before copying binaries reflects that prioritization, making this the correct principle.

/etc/login.defs contains configuration settings for the shadow password suite, including the ENCRYPT_METHOD variable, which defines the default password hashing algorithm (e.g., SHA512). Editing this file allows the administrator to enforce a strong, salted algorithm for new passwords. This is the correct file because it controls system-wide password policy defaults.

Perfect forward secrecy derives each session key from ephemeral values that are discarded after the exchange, so a later compromise of a session key or long-term secret cannot reconstruct other sessions' keys. This directly satisfies the requirement that no session key reveal another or the long-term authentication secret.

Group Managed Service Accounts (gMSAs) are domain accounts whose passwords are managed by Active Directory and rotated automatically every 30 days. They can be used across multiple servers, and the password is not stored locally; instead, the Key Distribution Service (KDS) root key is used to derive the password. This meets all the stated requirements.

This Group Policy setting configures the source computers to forward events to a specific collector. It specifies the collector's FQDN and the subscription manager, enabling automatic forwarding of security events. This is the correct method to centrally collect logs from many workstations without manual configuration on each machine, and it supports filtering and scalability for enterprise environments.

The 'ip route show' command displays the kernel routing table, including the default route typically marked with 'default via'. This directly answers the administrator's need to identify the default gateway. It is the modern replacement for the deprecated 'route' command and works consistently across current Linux distributions.

When a setuid program is executed, the kernel sets the process's effective UID to the file owner's UID, while the real UID stays as the invoking user's UID. The saved set-user-ID is also set to the file owner's UID, allowing the process to drop and later regain the effective privilege. This is exactly how /usr/bin/passwd can write to /etc/shadow while a normal user runs it.

Locking the root password with passwd -l root prepends an exclamation mark to the hash in /etc/shadow, disabling password-based logon for root while still allowing services and sudo to function. Granting named accounts sudo privileges ensures accountability and satisfies the policy that administrative tasks be performed through individual accounts with elevation.

A NIDS receiving a copy of inter-segment traffic via a SPAN port analyzes packets for known attack signatures and anomalies. If malicious traffic crosses the segmentation boundary, the NIDS raises an alert, providing the detective layer the architect wants. It does not block traffic, which matches the requirement for detection rather than prevention.

This event explicitly indicates that a logon session has been assigned special privileges. It is the definitive audit log entry for identifying administrative access at the moment of login, providing a clear trail for security analysts monitoring for unauthorized privilege usage.

CIS RAM is a prescriptive risk assessment method designed to help organizations implement the CIS Controls by identifying and prioritizing risks. It provides a structured approach to measure security posture and make informed decisions about resource allocation, directly supporting the CISO's goal of tracking effectiveness and prioritizing improvements.

A pass rule placed before the detection signatures tells the sensor to ignore traffic from the trusted scanner, while scan-detection signatures still fire for any other source probing the research subnet. This preserves visibility of real reconnaissance and suppresses the known benign weekly scan, which is precisely the tuning the requirement demands on a SPAN-based sensor.

SAE (Simultaneous Authentication of Equals) provides stronger protection than the PSK mechanism used in WPA2. It defends against offline dictionary attacks because the key exchange does not rely on a simple hash of the password, preventing attackers from capturing the handshake to crack it later.

Share permissions act as the first gatekeeper for network resources. If the Share permission is set to 'Deny' or does not include the user, they cannot access the contents regardless of their NTFS permissions. Both layers must permit access for the user to view or modify files.

IMDSv2 requires a PUT request to obtain a session token before metadata can be read, which blocks simple server-side request forgery and many credential-theft techniques. Setting the hop limit to 1 prevents containers and proxies from reaching the metadata endpoint. Together these controls protect the instance role credentials while legitimate application code can still retrieve them using the token flow.

ASLR randomizes the base addresses of executable images, DLLs, the stack, and the heap, which makes it difficult for an attacker to reliably predict where code or gadgets reside. Enforcing ASLR system-wide through Windows Defender Exploit Guard's mandatory ASLR setting ensures that even applications not compiled with ASLR support are randomized, increasing the difficulty of exploitation. This is the second correct hardening feature for the scenario.

The systemextensionsctl list command displays all installed system extensions and indicates whether each is approved by the user or pending approval. This directly addresses the compliance requirement to verify that only approved system extensions are loaded. It provides the necessary status information to confirm user approval.

The '-f' flag tells the tail utility to follow the file, meaning it will continuously display new lines as they are appended to the log. This is the industry-standard method for live log monitoring and immediate detection of authentication failures, such as repeated SSH login attempts or brute-force attacks.

To inspect TLS 1.3 payloads, the WAF must be a TLS endpoint, which means presenting a certificate and possessing the corresponding private key so it can decrypt, examine, and re-encrypt sessions. Without this termination capability the WAF only sees ciphertext and cannot evaluate HTTP request content, making it useless against application-layer attacks on the portal.

Performing a documented, periodic restore test is the core requirement for Control 11. It proves that the backup system is working as intended, data is not corrupted, and the team knows the necessary steps to recover critical business systems within the required recovery time objectives after an incident.

If the client code ignores certificate validation, it fails to verify the digital signature of the certificate against trusted Root CAs. This allows any attacker to issue a fraudulent certificate for the target domain, which the client will accept as valid, thereby facilitating a successful man-in-the-middle attack scenario.

Script block logging records the de-obfuscated script content that PowerShell actually executes, even when the command line is Base64-encoded, and module logging captures pipeline execution details. Forwarding those events to a central collector preserves the decoded payload for investigation while giving defenders visibility into the malicious behavior, directly mitigating this encoded PowerShell execution scenario.

The kmutil showloaded command displays information about currently loaded kernel extensions and other kernel collections. It is a modern replacement for kextstat and provides detailed output that can help identify unauthorized or malicious kexts. It is an appropriate tool for investigating kernel-level compromise on macOS.

Using separate accounts ensures that each administrator's actions are logged under their unique account. This allows auditing and traceability. Shared accounts prevent attribution. By implementing individual accounts, you can track who performed which action. This is a fundamental principle of accountability and directly solves the scenario's requirement.

In Windows access control, explicit Deny entries in an ACL override any Allow permissions, whether inherited or explicit. Because Elena is a member of 'Contractors', the Deny for Write applies directly to her, blocking the Modify permission from 'Project_X'. This is by design to ensure security restrictions are enforced.

This approach aligns with CIS Control 14 by providing continuous, practical training through simulated phishing attacks. Immediate feedback educates users in the moment, and tracking improvement measures the program's effectiveness. It goes beyond mere completion tracking to actively reduce susceptibility by reinforcing secure behavior and adapting training based on results.

If an attacker has stolen credentials, simply removing the backdoor is insufficient because the attacker can still authenticate using the compromised account. Resetting passwords is a mandatory eradication step to prevent the adversary from regaining access via legitimate authentication channels after the malicious artifacts are removed.