GIAC Security Essentials (GSEC) — Questions 301–351

By implementing multiple, heterogeneous layers of security, an organization forces an attacker to expend more time and resources. Each additional layer increases the complexity of the attack chain, raising the likelihood of detection and providing more opportunities for the security team to identify and stop the adversary.

visudo -c parses the sudoers file and any included files, reporting syntax errors without modifying anything, while a recursive grep across /etc/sudoers and /etc/sudoers.d identifies all NOPASSWD grants. Together they provide reliable syntax validation and a complete inventory of passwordless command authorizations, which is exactly what the engineer needs for verification.

Argon2 is the winner of the Password Hashing Competition and is designed to resist GPU cracking. It allows tuning of time cost (CPU), memory cost, and parallelism. This makes it highly adaptable to different hardware and security requirements. The scenario explicitly requires tuning of CPU and memory costs and resistance to GPU attacks, which Argon2 delivers. It is the recommended choice for new applications.

Runtime injection ensures that secrets reside only in the memory of the container and are not persisted in the image layers. This prevents secrets from being exposed through registry access or image analysis, allowing for easier rotation and centralized auditing of secret usage within the containerized application environment.

When the JWT header specifies "alg": "none", it means the token has no signature. An attacker can alter the payload (e.g., change user privileges) and since there is no signature to verify, the server may accept the modified token if it does not properly reject "none" algorithms. This is a critical vulnerability that can lead to authentication bypass and privilege escalation.

The spctl command is the system policy control tool that evaluates Gatekeeper assessments. Using --assess with --type execute and --verbose against the app path returns whether the app is accepted by Gatekeeper and the reason for rejection, directly confirming notarization and Developer ID signing status for the specified app.

Hypervisor-level distributed switching capabilities can securely replicate internal virtual machine traffic patterns and send packet copies to virtualized sensor nodes. This out-of-band monitoring approach guarantees comprehensive visibility into east-west communications without risking packet drop or network downtime.

Projected service account tokens provide automatically rotated, cryptographically signed tokens with strict audience limitations. This ensures that even if a token is exfiltrated, its lifespan is extremely short and its usability is strictly bounded to intended APIs.

CIS Control 6 requires managing the lifecycle of user accounts, including periodic reviews to disable inactive accounts. Quarterly reviews help ensure that accounts are removed when no longer needed, reducing the attack surface. This action directly supports the control's intent.

An explicit Deny permission on C:\Audit overrides any inherited Allow permissions for that folder and its subfolders. Since the Deny is applied only to C:\Audit, it does not affect other folders on the C: drive. Thus, Temp_Contractors are denied access to C:\Audit but retain access elsewhere as per inherited permissions.

The Secondary Logon service (seclogon) enables users to start processes under alternate credentials. If this service is disabled, the 'Run as different user' option will fail, and users will not be able to use runas.exe or Shift+right-click to launch applications with different credentials. This is the primary function of the service.

This cmdlet allows an auditor to list all members of the local Administrators group. Monitoring this group is vital, as attackers often add malicious accounts or elevated service accounts to maintain control over the compromised host during the post-exploitation phase.

Per-user SSH keys with password authentication disabled prevent credential reuse and brute-force attacks against the build host. Individual keys create accountability and allow revocation without disrupting other engineers. This strengthens identity controls at the host layer, making initial compromise harder and limiting attacker movement.

Microsoft transitioned feature updates for Windows to an annual release cadence occurring in the second half of the calendar year (H2). This predictable annual schedule simplifies IT planning, allowing organizations to establish consistent validation and deployment pipelines.

The -nodes flag explicitly disables encryption of the generated private key. This means the key is saved in cleartext, creating a significant security risk where any user or process with read access to the file can steal the identity of the server without needing to provide a password.

Sysmon Event ID 1 (Process Create) captures the image path, command line, hashes, parent process ID, and parent image for each new process. This directly documents which process spawned the attacker's executable and the children it created, even after the binary is deleted. It is the most reliable volatile artifact for reconstructing the parent-child relationship in this scenario.

An isolated guest subnet with an ACL that denies RFC 1918 destinations enforces the no-internal-access requirement at the point where guest traffic is anchored. Explicitly permitting the captive portal host and internet destinations preserves the required services, and the deny rule prevents guests from reaching internal subnets even if they discover their addresses. This is the standard guest-anchor enforcement model.

This approach implements a 'whitelist' strategy, which is the most secure method for firewall configuration. By dropping all traffic by default, the administrator ensures that only the traffic explicitly defined (in this case, SSH) can reach the server, effectively closing all other ports and reducing the attack surface.

HR travel records can confirm whether the user is authorized to be in that geographic location, directly addressing the question of legitimate travel. If a travel request exists for the same timeframe, it supports the benign explanation. If not, it increases suspicion of compromise. This source provides authoritative business context that is not available in technical logs, making it the best additional data source for this determination.

An inline Layer 2 bridge inspects traffic between the two VLANs while remaining transparent to IP addressing, and a hardware bypass fail-to-wire segment physically shunts packets around the appliance if it loses power, preserving connectivity for clinical systems. This directly satisfies both the inspection and the survivability requirements without renumbering hosts or altering routing.

Windows Update for Business enables administrators to define a specific target version, such as Windows 10 version 21H2, directly through Group Policy or MDM solutions. This capability ensures endpoints remain pinned to that exact release until the policy is explicitly changed, preventing unexpected disruptions from subsequent annual feature upgrades.

Docker builds images as a stack of immutable layers. Deleting a file in a subsequent layer only adds a whiteout marker; the original layer still contains the file's bytes and can be extracted by anyone with the image. This is why secrets copied into any layer remain recoverable, directly explaining the leak the engineer observed.

/etc/shadow stores password hashes and must be protected from unauthorized reading. Setting permissions to 640 or 000 with root ownership prevents non-privileged users from accessing hashes, mitigating offline cracking. This is a fundamental security measure for secure password storage. It complements complexity policies by protecting the stored hashes.

DHCP uses UDP because the client initially has no IP address and must broadcast. The server listens on UDP port 67 and the client uses UDP port 68. The four-step DORA exchange (Discover, Offer, Request, Acknowledge) fits this model. This combination correctly matches both the transport protocol and the port assignments observed in the scenario.

System Integrity Protection restricts the root user from modifying protected locations like /System, /bin, and /usr. By enforcing signed kernel extensions and preventing unauthorized modifications to system processes, it directly protects the kernel integrity, ensuring that only trusted, Apple-approved code can operate at the system core level.

The access token is created during logon and contains the user's SID, group SIDs, and privileges. It is attached to every process or thread the user runs and is used by the Security Reference Monitor to perform access checks against objects' security descriptors. Thus, it is the data structure that holds the security context for access evaluation.

The HttpOnly attribute instructs the browser to prevent client-side scripts from accessing the cookie. This directly mitigates XSS attacks that attempt to steal session cookies via document.cookie. When set, the cookie is only accessible to the server, not JavaScript. This is the correct attribute to use for the described requirement.

The EnableScriptBlockLogging registry value, when set to 1, enables script block logging. This causes PowerShell to log script blocks to the Windows Event Log, specifically Event ID 4104. This is the correct value to configure under the ScriptBlockLogging key. It is a common security control to detect malicious scripts and is often set via Group Policy or manually.

Threshold signing requires a quorum of distinct private keys, often held in separate HSMs or by separate administrators, to produce one valid signature. An attacker who compromises a single key cannot meet the threshold, so forged updates fail verification. This directly addresses the goal of making single-key compromise insufficient, and it is supported by standards such as FIPS 186-5 and common HSM quorum configurations.

HttpOnly prevents JavaScript from reading the cookie content. In an XSS scenario, an attacker typically tries to exfiltrate the session cookie to an external server. With the HttpOnly attribute, the browser rejects requests from scripts to read the cookie, effectively neutralizing this specific theft vector during an injection.

Client-side encryption with customer-managed keys stored on-premises ensures that data is encrypted before it leaves the organization's control, and the cloud provider never has access to the keys. This satisfies the requirement that the provider cannot access plaintext, as the provider only stores encrypted blobs. It also aligns with compliance requirements for protecting sensitive health information.

This policy, available in Office 2016 and later, blocks macros in files that originate from the Internet (e.g., downloaded from email or web). It directly addresses the scenario where a user opens a malicious document from an external source, while still allowing macros in trusted internal files. It is a targeted, effective control that does not require disabling macros entirely.

VXLAN uses the 24-bit VNI to identify a Layer 2 segment. Mapping each tenant to a distinct VNI and bridge domain ensures that BUM traffic is scoped to that tenant's segment only. VTEPs flood BUM frames only to other VTEPs that have the same VNI, so one tenant's broadcast domain cannot reach another tenant's endpoints. This directly satisfies the isolation requirement.

Enrichment adds context to raw events, enabling more accurate correlation and prioritization. For example, knowing that a server is critical or that a user is a privileged administrator helps analysts assess the severity of an alert. Geolocation can highlight impossible travel. This task is essential for effective alerting because it reduces false positives and helps focus on high-risk activities. It complements normalization by adding business-relevant metadata.

Scoping the execution role to only the bucket and table the function needs removes the broad administrative permissions and limits the blast radius if the function is compromised. This directly implements least privilege for the serverless workload while preserving its required read and write operations.

An admission controller such as one backed by Sigstore Cosign or a policy engine can reject pod creation unless the image carries a valid signature or attestation from the firm's scanner. This enforces the requirement at the API server before scheduling, ensuring only scanned, approved images reach the cluster.

HIDS agents monitor host-level activity such as file changes, process execution, and unauthorized access attempts, providing visibility into attacker actions on the database server. This directly addresses the lack of host-based logging and would help detect similar credential-based intrusions. It adds a detective layer at the host level, complementing network controls.

Windows Update for Business schedules updates based on device activity and connectivity. If the device is offline, in sleep mode, or not connected to the internet during the update's release, it will not download and install the update until it becomes active and connected. This can cause delays even without deferral policies. The 30-day delay suggests the device missed the initial release window due to being offline or inactive, which is a common cause in WUfB environments.

On Linux, unlinking a file only removes the directory entry (the name-to-inode link). The inode's link count drops, but the inode and its data blocks are not reclaimed while any process still holds an open file descriptor. The analyst can recover the content through /proc/<pid>/fd/<n>, which is why the data remains accessible to rsyslogd until it is restarted or closes the descriptor.

This setting allows you to deny NTLM authentication for domain accounts. When set to 'Deny all,' it blocks NTLM authentication requests for domain accounts, forcing Kerberos. This directly addresses the scenario by preventing NTLM use entirely within the domain.

Regular auditing of service account privileges helps identify and remediate excessive permissions. Rights like 'Act as part of the operating system' and 'Debug programs' are highly sensitive and should be restricted to only those accounts that absolutely require them. Removing unnecessary rights reduces the potential impact if an account is compromised. This option is correct because it enforces least privilege and helps prevent privilege escalation, aligning with hardening best practices.

WPS (Wi-Fi Protected Setup) is highly insecure because the PIN validation process is flawed. Attackers can brute-force the PIN in small segments, eventually retrieving the network PSK. This vulnerability exists regardless of how strong the actual WPA2 password is, making it a critical security risk for any network.

The MFT is a relational database that acts as the backbone of NTFS. It stores the metadata for every file and folder on the partition, including the primary timestamps (Standard Information and File Name attributes) used for forensic timeline analysis and detecting file modification or deletion events.

Isolating the host prevents the attacker from issuing further commands or exfiltrating data, effectively containing the threat. By cutting the network path, you stop the malicious script from reaching its destination without destroying the volatile memory evidence needed to identify the full scope of the attack activity.

The 700 octal mode provides full control to the owner (rwx) and explicitly denies all access to group and other users. This ensures that only the file owner can interact with the script, effectively mitigating risks associated with unauthorized execution or inspection of sensitive administrative tasks on the Linux system.

Applying security patches and updates is part of eradication because it addresses the vulnerability that may have been exploited. Even if the malware is removed, without patching, the server remains vulnerable to re-infection. Eradication involves not only removing the threat but also eliminating the root cause. Patching is a preventive measure that strengthens the system against future attacks.

Egress filtering inspects and blocks outbound traffic at router and firewall interfaces, permitting only approved ports and protocols. This directly prevents the unexpected outbound administrative channels observed, satisfying the requirement to restrict unauthorised outbound communication at the network perimeter.

A demilitarized zone architecture establishes a dedicated buffered network segment protected by firewalls. This design ensures that traffic from the internet can only reach designated public services while strictly prohibiting direct connections from the perimeter into the trusted internal network.

Defense in depth is an information security strategy that integrates multiple layers of security controls throughout an IT system. Its primary goal is to protect data by ensuring that if an attacker bypasses one defense, subsequent layers remain to prevent unauthorized access or minimize the overall impact.

Automated response tools rely on playbooks to determine actions. If these are not pre-defined and tested, the tool could inadvertently disrupt business operations. Validated playbooks ensure the automation performs safe and effective containment actions without requiring manual intervention, which is essential during a fast-moving, high-severity security incident.

Conditional Access policies in Entra ID allow granular control over authentication requirements, including the ability to target specific cloud applications. By creating a policy that includes the line-of-business application as the target and requires MFA, the security team can enforce MFA only for that app. This approach leverages Entra ID P1 features and does not affect other applications. It is the recommended method for per-application MFA enforcement.