GIAC Security Essentials (GSEC) — Questions 226–300

A distinct guest SSID bound to its own VLAN keeps guest traffic on a segmented broadcast domain, and client isolation prevents guests from reaching each other. With no routing or ACL permitting access to internal subnets, point-of-sale systems stay unreachable. This satisfies open or captive-portal guest access without distributing the corporate preshared key, which remains protected for internal users.

GPOs provide the primary mechanism for applying security policies and configurations across a domain. They allow for granular control and automated enforcement, ensuring that hardening standards are consistently applied to all managed workstations and servers in the environment.

The shared responsibility model defines which security tasks belong to the cloud provider and which belong to the customer. In IaaS, the provider secures the physical facilities, hosts, and hypervisor, while the customer secures the guest operating system, applications, and guest firewall rules. This directly matches the division the security lead wants to clarify.

The analyst observed that cmd.exe created a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' that runs a PowerShell script from AppData. This is a classic persistence technique using the Windows Task Scheduler, often executed via schtasks.exe or the Task Scheduler COM API. The task masquerades as a legitimate Microsoft Edge update task to avoid suspicion, confirming scheduled task persistence.

If the Sales group has an explicit Deny for Delete, that Deny takes precedence over the Allow from Managers. Even though Bob is a Manager with Full Control, the Deny from Sales membership blocks deletion. This is a classic case of Deny overriding Allow, and it explains why Bob cannot delete files despite having Full Control via another group.

IG1 is designed for small organizations with limited resources and low risk. It includes 56 basic safeguards that represent essential cyber hygiene. For a small marketing agency, IG1 provides a practical starting point to protect against common threats without overwhelming their IT staff. It is the recommended baseline for all organizations, regardless of size, but is particularly suited for those with constrained resources.

File integrity monitoring computes cryptographic hashes of the claim files and stores a known-good baseline. On subsequent scans, any modification produces a hash mismatch, alerting the team even if the attacker used legitimate administrative privileges. This directly satisfies the requirement to detect unauthorized modification independently of access controls.

The /etc/passwd file contains the login shell for each user in its seventh field. By checking this file, the administrator can verify that the 'www-data' account has a non-login shell such as /usr/sbin/nologin or /bin/false, which prevents interactive logins and reduces privilege escalation risk if the service is compromised.

TargetReleaseVersion and TargetReleaseVersionInfo are the supported WUfB policies to pin a device to a specific Windows feature update version. Setting the target version to 1809 prevents the device from moving to a later feature update while still allowing quality updates. This is the correct way to keep devices on a specific build for compatibility.

By setting 'allowPrivilegeEscalation' to false, the container runtime prevents the process from gaining more privileges than its parent. This effectively neutralizes setuid binaries that could otherwise be leveraged by an attacker to elevate their privileges from a standard user to root within the container's isolated execution environment.

BitLocker with a TPM and PIN protector requires a user-entered PIN before the operating system loads, providing pre-boot authentication. This means an attacker who steals the laptop cannot simply boot it to reach the decryption keys in memory, significantly reducing cold-boot and DMA attack risk. The TPM also seals keys to the platform, so moving the drive to another computer does not allow decryption, meeting the confidentiality requirement.

Separate virtual machines on the same host give each team its own kernel and its own isolated process table, so one build cannot inspect another build's environment variables and cannot traverse into another tenant's mounted paths. Because the containers shared one Docker Engine instance, the kernel-mediated isolation was insufficient; moving to per-team VMs restores a hardware-enforced boundary that directly prevents both observed exposures.

The analyst deleted files before containing the workstation, leaving it networked and allowing the malware to spread or communicate. Proper sequence is containment then eradication. Deleting files with elevated credentials also risks tipping off the attacker and destroying volatile evidence. This is the most direct violation of the containment-first principle.

The stat command displays detailed file metadata including the inode number, permissions, owner, group, size, and timestamps (access, modify, change). It provides all the requested information in a single output and does not modify the file. This makes it the ideal tool for forensic analysis where comprehensive file attributes are needed.

This approach directly addresses distributed brute-force attacks, where many source IPs each try a few passwords against the same account. By counting distinct source IPs per target account over a longer window, the search detects the attack pattern while ignoring isolated mistyped passwords from a single user. It reduces false positives because a single user typically fails from one or two IPs, not many, and it still catches the distributed behavior.

gVisor acts as a user-space kernel that intercepts and handles system calls. By limiting the number of system calls that reach the host kernel, it drastically reduces the available attack surface for privilege escalation and kernel exploits, effectively containing the potential damage from a compromised application within the guest.

The 's' in the owner's execute position indicates the Set User ID bit is active. Since the owner is root, any user running this binary will have their effective user ID changed to root. This allows the program to perform administrative tasks that the standard user would normally be restricted from.

A VM escape allows an attacker to bypass the isolation provided by the hypervisor and interact with the host OS. This is a severe security vulnerability that compromises the entire virtualization environment, potentially leading to unauthorized data access and total control over all virtualized assets on that host.

CIS CSAT is the official self-assessment tool that maps an organization's implementation of the CIS Controls to Implementation Groups and produces a quantifiable maturity score. It allows repeatable measurements over time, directly addressing the CISO's need to track program effectiveness and demonstrate progress against the CIS Controls framework.

Encrypting the tapes with AES-256 renders the data unreadable without the key, so a lost or stolen tape does not expose customer information. Managing keys separately from the tapes ensures the key is not lost with the media. This is the direct technical control that addresses the confidentiality risk described.

Overload often comes from inspecting irrelevant protocols and signatures, which consumes CPU and causes legitimate packets to be dropped. Profiling the segment and disabling unused signatures reduces processing load without removing inline prevention. This preserves enforcement while lowering false positives and false drops. It is the targeted, operationally sound adjustment because it aligns inspection scope with actual traffic rather than disabling protection.

Parameterized queries ensure that user input is treated as data, not executable code, by separating SQL logic from data. This prevents attackers from altering the query structure, regardless of the input's content. It is the most effective and fundamental mitigation against SQL injection, as it eliminates the vulnerability at the source rather than relying on pattern matching.

ASR rules such as blocking Office child process creation and process injection target the behaviors that macro-based malware relies on, regardless of whether the macro itself is signed. This preserves the ability to run the required unsigned macros while preventing the most common payload delivery and execution techniques, directly matching the scenario's need to reduce malicious macro risk without breaking functionality.

Generating the key inside the HSM and performing all signing operations within its tamper-responsive boundary means the private key is never exported in plaintext, even to a privileged host process. Root access on the appliance exposes the operating system, not the key material inside the module. This non-exportability is the defining property that satisfies the requirement and is standard practice for CA key protection.

Microsegmentation enforces least privilege by defining granular allow rules between workloads. Restricting SMB access to only the HR subnet prevents the contractor's laptop, which resides elsewhere, from reaching the payroll server, even though it is on the internal network. This directly addresses the lateral movement path discovered in the exercise and aligns with defense in depth at the host and network layers.

The restricted profile is the most stringent of the Pod Security Standards and directly rejects pods that violate its controls, such as running as root or lacking a seccomp profile. Rejection occurs at admission time, so the non-compliant pod never reaches a node, which directly addresses the engineer's goal of preventing root-running pods.

Time-based one-time password (TOTP) algorithms rely on synchronized clocks. If the token's clock drifts, the generated OTP will not match the server's expected value. Configuring a time drift window allows the server to accept OTPs from a few time steps before or after the current time, compensating for minor clock differences. This directly resolves the synchronization failures.

AppLocker is a built-in Windows feature that allows administrators to create rules based on file path, hash, or publisher to control which applications and scripts users can run. It integrates with Group Policy for centralized management. This directly meets the requirement for application whitelisting on Windows 10 workstations. Therefore, AppLocker is the correct choice.

Infrastructure as Code (IaC) uses machine-readable definition files to automate the deployment of cloud infrastructure. This ensures that security best practices, such as encryption and access control, are baked into the templates, creating a consistent and repeatable security posture across the entire organization.

The flood of unencrypted 802.11 management frames with a spoofed AP MAC address is characteristic of a deauthentication attack. These frames are sent to disconnect clients from the legitimate AP, often as a precursor to an evil twin or capture of the WPA handshake. The high rate and spoofed source confirm this is not normal traffic.

Event ID 4624 is the standard success audit for logons. Logon Type 3 is explicitly defined by Microsoft as a network logon, which occurs when a user or computer connects to a shared resource or service on the target machine from a remote source location.

Reverse proxy mode places the WAF inline for HTTP/HTTPS traffic, and anomaly detection with a learning period builds a behavioral baseline of legitimate requests. After the baseline is established, deviations from normal parameters, methods, and request patterns can be blocked without hand-written signatures. This directly matches the architect's requirement to learn normal behavior and block deviations, while reverse proxy mode gives the WAF full visibility and control over application traffic.

ASLR randomizes the base addresses of executable modules, stack, and heap, making it difficult for an attacker to predict where to place or find their payload. For a use-after-free, the attacker often needs to know the address of a freed object or a function pointer to overwrite; ASLR forces them to leak addresses first, increasing complexity and reducing reliability.

This is the classic screened-subnet design: internet clients reach only the web tier, and the database accepts connections solely from the web server's address on its specific port. If the web server is compromised, the attacker gains no direct path to arbitrary internal hosts, and the database is not exposed to the internet. It satisfies both reachability and isolation.

Distributed firewalls operate at the virtual NIC level, enabling granular security policies that follow the VM regardless of host migration. This effectively isolates workloads from each other, preventing lateral movement even if the attacker has gained local access, which is fundamental to zero-trust cloud security models.

Defense in depth is the systematic application of security controls across multiple layers, including perimeter, network, host, application, and data. This layered approach ensures that if a control at one layer fails or is bypassed, subsequent layers are in place to stop the attacker or limit damage.

The AllSigned policy mandates that all scripts, including local ones, must be digitally signed by a trusted publisher. This is the recommended security posture for preventing unauthorized script execution and ensuring integrity, making it a critical hardening step for any secure environment.

TLS_RSA_WITH_AES_128_CBC_SHA uses static RSA key exchange, meaning the premaster secret is encrypted with the server's long-term RSA key. If an attacker records the encrypted session and later obtains the server's private key, they can decrypt all past sessions. This violates forward secrecy, a critical property for protecting historical traffic. Modern best practice mandates ECDHE or DHE cipher suites to ensure each session has unique ephemeral keys.

SQL injection attempts often use encoded characters like %27 (single quote) to break out of SQL queries, %20 (space) to separate keywords, and %3D (equals) for comparisons. The fact that the server returned 200 OK suggests the requests were successful, possibly indicating a vulnerable application. These encoded characters are classic indicators of SQL injection probing, especially when repeated in URL parameters.

The presence of 'unsafe-inline' in the script-src directive allows the execution of inline JavaScript. This means that if an attacker can inject a <script> tag with malicious code, it will execute because the CSP does not block inline scripts. This significantly reduces the XSS mitigation that CSP would otherwise provide. Thus, the policy is insecure in this context.

Heterogeneous controls mean that a vulnerability, bug, or misconfiguration in one product is unlikely to affect another from a different vendor. If an attacker discovers a bypass in one firewall brand, the EDR or SIEM from another vendor may still detect or block the activity. This diversity creates independent failure domains, which is a core principle of defense in depth and directly supports the architect's recommendation.

During the TLS handshake the server transmits its X.509 certificate, and the client verifies the signature chain up to a trusted root, checks the subject name against the requested host, and confirms validity dates. Only after this validation does the client derive session keys and send the HTTP request. This is precisely the mechanism that authenticates the server's identity before application data flows on port 443.

CIS Control 1 is Inventory and Control of Enterprise Assets. It is the foundational control that requires maintaining an accurate, detailed inventory of all hardware and software. Without knowing what assets exist, other controls cannot be effectively applied. This is the first step in the CIS Controls.

The aide --check command compares the current file system state against the previously initialized AIDE database. It reports any changes, such as file additions, deletions, or modifications, based on the rules defined in the AIDE configuration. This is the correct command to perform a manual integrity check. It is typically run after the initial database is created and can be scheduled via cron for regular monitoring.

A web application firewall terminates and inspects HTTP and HTTPS at layer 7, blocking injection and other application-layer exploits that volumetric scrubbing cannot detect, satisfying the requirement to defend internal services against web application attacks.

Nessus uses SSH credentials to log into Linux and Unix hosts and run local commands for patch level, configuration, and vulnerability checks. Without valid SSH credentials, the scan falls back to unauthenticated checks, which are less accurate. Configuring SSH credentials is essential for authenticated scanning of Linux systems in a mixed environment.

Scheduled tasks are one of the most common Linux persistence mechanisms, and checking every user's crontab plus the system cron directories reveals jobs that re-establish access or re-download payloads at regular intervals. Because cron survives reboots, it directly answers how the attacker maintains access. Root crontabs and files under /etc/cron.d, /etc/cron.hourly, and related directories are the highest-value locations to inspect first.

Physical memory is the most volatile evidence and contains running processes, network connections, and injected code that vanish on shutdown. Capturing it first with a trusted, forensically sound tool satisfies the order of volatility while allowing containment afterward. This balances evidentiary integrity with the operational need to limit downtime, making it the best action in this scenario.

Restricting the tools and database fields the model can access limits what sensitive data can enter the prompt or response. If the assistant can only query order status and not full customer records, exposure is minimized even if the model is manipulated. This directly reduces the risk of sensitive data leakage through responses.

Stateful firewalls age out entries in the session table based on idle timers, and the default TCP idle timeout is often around an hour for established connections. If the SSH session carries no keepalive traffic during that window, the entry is purged and subsequent packets are treated as a new, unauthorized flow and dropped, matching the observed hourly disconnects.

PBAC uses policies that can incorporate a wide range of attributes and conditions, including environmental factors. It centralizes policy management and enables dynamic, fine-grained access decisions. Often considered an evolution of ABAC, PBAC explicitly emphasizes policy-driven evaluation. It fits the requirement for centralized policy management and auditing, and supports context-aware decisions such as time-of-day restrictions.

ECDHE leverages transient elliptic curve parameters for each unique handshake transaction. Because the server private key is only used to digitally sign the ephemeral exchange and is never used to derive the session key directly, past sessions remain entirely secure against future key compromises.

Verifying the detached PGP signature with the vendor's public key confirms both integrity and origin: a valid signature proves the file was signed by the holder of the corresponding private key and that the content has not changed since signing. This single verification satisfies both requirements. The administrator must first obtain and trust the vendor's public key through an out-of-band channel to avoid a substituted key.

A SPAN port mirrors copies of production traffic to the sensor, so the NIDS receives all packets without being inline. This preserves production flow because the sensor is passive and cannot drop or delay traffic. It also captures fragmented and error packets that the switch forwards to the mirror port, assuming the switch is configured to mirror all relevant VLANs and directions.

The lessons-learned meeting is part of the post-incident activity phase, but the specific finding about log integration directly addresses preparation. Improving log sources and SIEM integration enhances future readiness and detection capabilities. Preparation encompasses building and maintaining the tools and processes needed to respond effectively, so this finding aims to strengthen that phase.

Authenticated SSH scans typically use a key pair generated by the scanner. If the scanner's public key is not present in the target account's authorized_keys file, the scanner cannot authenticate even when manual password logins succeed. Adding the scanner's public key to the authorized_keys file for the scan account directly resolves this failure.

Windows services are configured under HKLM\SYSTEM\CurrentControlSet\Services. Each subkey corresponds to a service and contains values such as ImagePath, Start, and ObjectName. A malicious service would create a subkey here. This is the correct location to examine for service persistence.

IPsec offers a suite of protocols that provide encryption, integrity, and authentication at the network layer. By securing packets between two hosts, it ensures that even if internal traffic is intercepted, the payload remains unreadable and protected from tampering, which is necessary for sensitive data transmission.

MFA requires two or more distinct authentication factors, such as a password plus a hardware token, before granting access. This directly meets the requirement of requiring two distinct factors even from inside the network. It adds an identity-layer control that strengthens defense in depth against credential theft and insider misuse.

A BIOS or UEFI password prevents unauthorized users from changing the boot order or modifying hardware-level settings. This is the first line of defense against an attacker trying to boot the system from an external USB drive or optical media to gain access to the underlying data on the disks.

ICMP Timestamp replies expose a device's current clock and uptime, letting an attacker fingerprint the OS, infer patch cycles, and correlate hosts across the estate. On perimeter routers this reconnaissance data aids targeted exploitation, which is the specific risk the question asks about.

A gMSA is a domain account whose password is managed by Active Directory and automatically rotated. It supports Kerberos authentication, allows the service to access network resources, and can be shared across multiple servers without password reuse. This directly meets all requirements and is the recommended solution for services like SQL Server.

A salted, high-iteration KDF forces an attacker to spend significant work per guessed passphrase and prevents precomputed rainbow-table attacks across files. Because the salt is unique per file, identical passphrases still yield different keys, so copying a file without the passphrase leaves the attacker facing a costly brute-force effort.

The hostPath volume is what exposes the node's kubelet directory to the pod, and the namespace's privileged enforcement label is what allowed that volume to be admitted despite the cluster-wide restricted profile. Restoring restricted enforcement blocks hostPath volumes entirely and forces the legacy job to be reworked, directly removing the pod's ability to read node files. The other options leave the mount or the permissive label in place.

WIPS can automatically contain a rogue AP by sending deauthentication and disassociation frames to clients connected to that AP, effectively disconnecting them. This is a standard containment method. It disrupts the rogue AP's ability to serve clients. The administrator should enable this containment feature to automatically neutralize the threat without manual intervention, aligning with the scenario's requirement.

Authenticated scanning reads the actual installed package versions and patch levels, providing far more accurate results than banner-based inference. Manually verifying the vulnerability on the host confirms whether the issue truly exists. This approach resolves the discrepancy between the scanner's report and the administrator's claim without causing unnecessary disruption or acting on a possible false positive.

TCP half-open scanning, often called SYN scanning, involves sending SYN packets to probe ports. The attacker analyzes the responses to determine if ports are open, closed, or filtered. Because the full handshake is never completed, the scanning activity is harder to log on the target system.

When legitimate scripts must execute from /home, using mandatory access control such as SELinux booleans or AppArmor profiles restricts execution to approved binaries and paths without breaking the developer's workflow. This maintains defense in depth while allowing required functionality, unlike blunt mount options that would block all execution.

Event ID 4648 is logged when a process attempts to log on using explicitly provided credentials, such as when using RunAs or a scheduled task. In a credential theft scenario, an attacker might use stolen credentials to start a process, generating this event. Repeated occurrences for a service account can indicate malicious use of those credentials.

UDP eliminates the overhead of the three-way handshake required by TCP. By sending data immediately without establishing a stateful connection, UDP significantly reduces latency, which is essential for time-sensitive applications like DNS queries, streaming media, and VoIP, where retransmission delays would degrade the user experience.

PAM provides the capability to grant time-limited, Just-In-Time administrative access. By utilizing shadow principals and the MIM platform, organizations can provision temporary group memberships, ensuring that administrative accounts do not remain privileged indefinitely, which significantly mitigates the risk associated with account compromise.

Malicious actors encode stolen data or remote commands within the subdomains of DNS requests or inside TXT records. Inspecting query frequency, length, and entropy reveals the high-density encoded payloads characteristic of modern tunneling tools like Iodine.क्क

Memory forensics tools allow responders to examine the contents of RAM to find injected code, hidden processes, or tampered system calls. By comparing the memory state against a known-good baseline, analysts can identify the specific memory regions used by the file-less malware to maintain its stealthy presence.

A UTM appliance integrates several security services, such as antivirus, content filtering, intrusion prevention, and often VPN, into one device that traffic traverses. This consolidation is exactly what the owner wants: a single platform applying multiple inspection technologies to outbound flows without deploying separate dedicated appliances.

When WEF forwards events, they are encapsulated in XML. If the SIEM's default Windows parser expects a different format (e.g., EVTX or JSON), it will fail to extract fields, resulting in raw XML. Creating a custom parser that understands the WEF XML schema and maps fields like EventID, Computer, and SubjectUserName to the SIEM's normalized schema will enable proper parsing and correlation.