70 free GIAC Security Essentials GSEC practice questions from the CertStash pack of 279, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 70 free here, all 279 in the pack, and each step includes the one before it.
Get all 279 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which of the following are advantages of Network Intrusion Detection Systems (NIDS)?
Show answer and explanation
Correct answer: C. It watches many hosts from one sensor, it sees attacks that host-based sensors miss, and it still records an attack when the target host's own logging is disabled.
A network intrusion detection system watches traffic on the wire, so one well placed sensor covers every host on that segment instead of needing software on each machine. Because it works from the network rather than from the victim, it sees reconnaissance, scanning and attacks against hosts that carry no agent at all, and it keeps a record even when the targeted host has logging turned off or has been compromised and its logs tampered with. Option C states all three of those advantages. Options A, B and D each claim that a NIDS can read the contents of encrypted sessions, which it cannot without a decryption point, and they also claim it can confirm whether an attack actually succeeded on the target, which is a host-based strength rather than a network one. Options A, D and E further describe per-host agents and single-host coverage, which is the host-based model and the opposite of what a NIDS provides.
Why the other options are wrong
- A. Does not include all the correct advantages; missing D and E.
- B. Does not include advantage D about detecting attacks that bypass host logging.
- D. Does not include advantage E about inexpensive management; also missing D from the correct set.
Question 2
Which of the following protocols is used by a host that knows its own MAC (Media Access Control) address to query a server for its own IP address?
Show answer and explanation
Correct answer: A. RARP
RARP (Reverse Address Resolution Protocol) is specifically designed for a host to discover its own IP address when it knows its MAC address. A host with a known MAC address sends a RARP request to obtain the corresponding IP address from a RARP server.
Why the other options are wrong
- B. ARP does the opposite, it resolves IP addresses to MAC addresses, not MAC to IP.
- C. DNS resolves domain names to IP addresses, not MAC addresses to IP addresses.
- D. RDNS (Reverse DNS) performs reverse lookups of IP addresses to domain names, not MAC to IP resolution.
Question 3
What is the motivation behind SYN/FIN scanning?
Show answer and explanation
Correct answer: C. The crafted SYN/FIN packet sometimes gets past firewalls and filtering routers.
SYN/FIN scanning exploits the unusual combination of flags (SYN and FIN set simultaneously) to craft packets that may evade firewall rules and filtering routers. Many firewalls are configured to block standard connection attempts but may not properly handle or filter these non-standard packet combinations, allowing them to pass through.
Why the other options are wrong
- A. SYN/FIN packets are not a standard signaling mechanism for Trojans.
- B. While SYN floods are used in DoS attacks, SYN/FIN combinations are not a typical DoS vector, nor are they specifically targeted at BSD hosts.
- D. Session hijacking uses sequence number prediction and packet injection, not SYN/FIN scanning techniques.
Question 4
There is not universal agreement on the names of the layers in the TCP/IP networking model. Which of the following is one of the functions of the bottom layer which is sometimes called the Network Access or Link Layer?
Show answer and explanation
Correct answer: D. Defines the procedures for interfacing with Ethernet devices
The Network Access or Link Layer (the bottom layer of the TCP/IP model) handles the physical transmission of data and defines how devices interface with network hardware. This includes procedures for interfacing with Ethernet devices, managing MAC addresses, and handling physical frame transmission.
Why the other options are wrong
- A. This is a function of the Transport or Application layer, which provides end-to-end services for applications.
- B. Routing is performed at the Internet layer, not the Link layer.
- C. IP addressing is an Internet layer function, and encryption can occur at multiple layers but is not a primary Link layer responsibility.
Question 5
Which of the following is a private, RFC 1918 compliant IP address that would be assigned to a DHCP scope on a private LAN?
Show answer and explanation
Correct answer: C. 10.254.1.50
RFC 1918 defines three ranges of private IP addresses: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The address 10.254.1.50 falls within the 10.0.0.0/8 range and is a valid private address suitable for DHCP assignment on a private LAN.
Why the other options are wrong
- A. 127.0.0.100 is a loopback address, not a private RFC 1918 address.
- B. 169.254.1.50 is in the link-local range (169.254.0.0/16), not an RFC 1918 private range.
- D. 172.35.1.100 falls outside the RFC 1918 private range of 172.16.0.0/12; it is a public address.
Question 6
When using Pretty Good Privacy (PGP) to digitally sign a message, the signature is created in a two-step process. First, the message to be signed is submitted to PGP's cryptographic hash algorithm. What is one of the hash algorithms used by PGP for this process?
Show answer and explanation
Correct answer: C. SHA-l
SHA-1 (Secure Hash Algorithm 1) is one of the cryptographic hash algorithms used by PGP for creating digital signatures. PGP uses SHA-1 to hash the message before encrypting the hash with the sender's private key to create the digital signature.
Why the other options are wrong
- A. Blowfish is a symmetric encryption cipher, not a hash algorithm used by PGP for signatures.
- B. DES is a symmetric encryption algorithm, not a hash algorithm used in PGP's signature process.
- D. CAST is a symmetric encryption cipher, not a hash algorithm used by PGP for digital signatures.
Question 7
You are the security director for an off-shore banking site. From a business perspective, what is a major factor to consider before running your new vulnerability scanner against the company's business systems?
Show answer and explanation
Correct answer: A. It may harm otherwise healthy systems.
Running a vulnerability scanner against production banking systems carries significant risk of causing harm to otherwise healthy systems. Vulnerability scanners perform active probing and testing that can crash services, cause data corruption, or trigger resource exhaustion on sensitive production systems, making pre-scan impact assessment critical.
Why the other options are wrong
- B. False negatives are a technical limitation but not the primary business concern when deciding whether to run a scanner.
- C. False positives are a technical issue requiring validation but are less critical than the risk of system damage.
- D. While cost-benefit analysis is important, the immediate risk of harming production systems is a more critical business factor.
Question 8
Which of the following is a benefit to utilizing Cygwin for Windows?
Show answer and explanation
Correct answer: B. The ability to bring much more powerful scripting capabilities to Windows.
Cygwin provides Windows users with access to GNU/Linux utilities and tools, enabling much more powerful command-line scripting and Unix-like capabilities on Windows systems. This includes bash shells, sed, awk, grep, and other powerful text processing and scripting tools unavailable natively in Windows.
Why the other options are wrong
- A. Cygwin does not install a complete Red Hat operating system on Windows; it provides Unix-like tools and utilities within Windows.
- C. While Apache can technically run under Cygwin, it is not intended as a production server solution and Cygwin is not suitable for production deployments.
- D. Cygwin does not install a complete Ubuntu operating system on Windows; it provides a Unix-like environment and toolset.
Question 9
What technical control provides the most critical layer of defense if an intruder is able to bypass all physical security controls and obtain tapes containing critical data?
Show answer and explanation
Correct answer: C. Encryption
Encryption is the critical technical control that protects data confidentiality even after physical security is breached. If an intruder obtains encrypted tapes, the data remains unreadable without the decryption keys. This is a detective/preventive control that provides the last line of defense when physical security fails, making it more effective than other options which either don't protect the data itself or are detective-only controls.
Why the other options are wrong
- A. Camera recordings document a breach but do not protect the data on the tapes from unauthorized access.
- B. Security guards are a physical control that has already been bypassed by assumption in the question.
- D. Shredding is a destruction method, not applicable to tapes still in use for critical data.
- E. Corrective controls address issues after they occur but do not prevent unauthorized data access if tapes are obtained.
Question 10
Two clients connecting from the same public IP address (for example - behind the same NAT firewall) can connect simultaneously to the same web server on the Internet, provided what condition is TRUE?
Show answer and explanation
Correct answer: C. The client-side source ports are different.
When two clients share the same public IP address behind a NAT firewall, the server distinguishes between them by their source ports. The NAT device translates each client's unique internal source port to different ports in outbound connections, allowing the server to maintain separate connections to both clients. This 5-tuple identification (source IP, source port, destination IP, destination port, protocol) is what enables simultaneous connections from the same public IP.
Why the other options are wrong
- A. The port number used by the server is irrelevant; simultaneous connections work on any server port with different client source ports.
- B. The network location of the server is irrelevant; the distinction happens at the NAT layer.
- D. Clients on different subnets still share the same public IP when behind the same NAT device, so this is not the determining factor.
What people say about the full Security Essentials GSEC pack 4.6 from 8
The GSEC training dumps are 100% accurate. And i did my preparation from these GSEC exam dumps only. I passed the exam with flying colours. Thank you so much!
GSEC passed on the first attempt.
I failed GSEC exam twice before, it is a nightmare. But I passed the GSEC exam and I really want to thank you.
Question 11
Which of the following is a backup strategy?
Show answer and explanation
Correct answer: A. Differential
Differential backup is a recognized and widely-used backup strategy that backs up only the data that has changed since the last full backup. It reduces storage space and backup time compared to full backups while maintaining faster recovery than incremental backups.
Why the other options are wrong
- B. Integrational is not a standard backup strategy terminology used in IT.
- C. Recursive is not a backup strategy; it is a programming/file system concept.
- D. Supplemental is not a recognized backup strategy; backup strategies are full, incremental, differential, and mirror.
Question 12
In order to capture traffic for analysis, Network Intrusion Detection Systems (NIDS) operate with network cards in what mode?
Show answer and explanation
Correct answer: C. Promiscuous
Network Intrusion Detection Systems (NIDS) operate network interface cards in promiscuous mode, which allows the card to capture all traffic on the network segment regardless of whether the packets are addressed to that specific interface. This capability is essential for analyzing network traffic patterns and detecting intrusions.
Why the other options are wrong
- A. Discrete mode is not a standard network interface operating mode.
- B. Reporting mode is not a recognized network interface mode for traffic capture.
- D. Alert mode is not a network interface operational mode; it is a NIDS response state.
Question 13
The TTL can be found in which protocol header?
Show answer and explanation
Correct answer: B. It is found in byte 8 of the IP header.
The Time-To-Live (TTL) field is located in byte 8 of the IP header (IPv4). It is an 8-bit field that decreases by one at each hop and is used to prevent packets from circulating indefinitely in routing loops.
Why the other options are wrong
- A. ICMP messages are carried within IP packets; the TTL is in the enclosing IP header, not the ICMP header.
- C. TCP operates at Layer 4 and does not contain a TTL field; that function belongs to the IP layer.
- D. DNS operates over UDP or TCP at Layer 4; the TTL function exists at Layer 3 in the IP header.
Question 14
Which of the following statements would describe the term "incident" when used in the branch of security known as Incident Handling?
Show answer and explanation
Correct answer: D. An adverse event that violates, or threatens to violate, an organization's security policy or its established security baseline.
In incident handling, an incident is an adverse event, or a series of related events, that violates or threatens to violate the organization's security policy or falls below its established security baseline. That definition covers unauthorized access, malware infection, data disclosure and denial of service, and it is what distinguishes an incident from ordinary activity: it has a negative effect on the confidentiality, integrity or availability of systems or data and therefore requires investigation and a response. Option D states that definition. Option A describes an event, which is any observable occurrence and carries no security judgement at all. Option B describes an alert, which is only an indication that something may warrant review and may well turn out to be a false positive. Option C describes a vulnerability, a weakness that could be exploited later, rather than something that has actually happened.
Why the other options are wrong
- A. Incomplete definition that omits key characteristics of what constitutes a security incident.
- B. Contains incorrect elements that do not align with standard incident handling terminology or definitions.
- C. Missing essential components that define incidents in the context of security operations.
Question 15
You are examining an IP packet with a header of 40 bytes in length and the value at byte 0 of the packet header is 6. Which of the following describes this packet?
Show answer and explanation
Correct answer: D. This is an IPv6 packet with a TCP payload.
A 40-byte header length indicates IPv6 (IPv4 headers are typically 20 bytes minimum, IPv6 headers are fixed at 40 bytes). In both IPv4 and IPv6, byte 0 contains the version in the first 4 bits and additional header fields. In IPv6, the next header field (at byte 6) indicates the payload protocol, where a value of 6 specifically indicates TCP. Therefore, this is an IPv6 packet with TCP payload.
Why the other options are wrong
- A. A 40-byte header is characteristic of IPv6, not IPv4; also the value 6 in the next header field indicates TCP, not unspecified.
- B. The 40-byte header indicates IPv6, not IPv4.
- C. While the 40-byte header correctly identifies IPv6, a value of 6 in the next header field specifically indicates TCP, not an unspecified protocol.
Question 16
Which Defense-in-Depth model involves identifying various means by which threats can become manifest and providing security mechanisms to shut them down?
Show answer and explanation
Correct answer: A. Vector-oriented
Vector-oriented defense involves identifying the various attack vectors (means by which threats manifest) and implementing specific security controls to neutralize each threat vector. This approach focuses on understanding threat pathways and deploying countermeasures against each identified vector.
Why the other options are wrong
- B. Uniform protection applies the same security measures across all systems without regard to specific threat vectors.
- C. Information centric defense focuses on protecting data based on its classification and sensitivity, not on threat vectors.
- D. Protected enclaves involve creating isolated security zones rather than addressing specific threat manifestation paths.
Question 17
What is the name of the registry key that is used to manage remote registry share permissions for the whole registry?
Show answer and explanation
Correct answer: C. winreg
The WINREG registry key is the root key used to manage remote registry share permissions and controls access to the entire registry remotely. It is the standard system registry key that governs remote registry operations and permissions across the whole Windows registry structure.
Why the other options are wrong
- A. REGKEY is not a valid Windows registry key name for managing remote permissions.
- B. REGMNG is not a recognized Windows registry key for remote registry management.
- D. RRSREG is not a valid Windows registry key used for remote registry share permissions.
Question 18
When should you create the initial database for a Linux file integrity checker?
Show answer and explanation
Correct answer: C. Before a system has been compromised
A file integrity checker database must be created before a system is compromised to establish a clean baseline of file hashes and metadata. This baseline is then used to detect unauthorized changes by comparing current file states against the original baseline. Creating the database after compromise would capture malicious modifications as legitimate, rendering the tool ineffective for detecting the attack.
Why the other options are wrong
- A. Creating the baseline before patching could capture an insecure state; it should be created after hardening but before exposure to attack.
- B. Creating a database after compromise defeats the purpose, as malicious changes would be included in the baseline.
- D. Creating a database during an active attack is too late to establish a trustworthy baseline.
Question 19
What type of formal document would include the following statement? Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal application of Internet/Intranet/Extranet systems. In the absence of such policies, employees should be guided by departmental policies, and if there is any uncertainty, employees should consult their supervisor or manager.
Show answer and explanation
Correct answer: C. Acceptable use policy
An Acceptable Use Policy (AUP) defines guidelines for appropriate use of company systems and resources by employees. The quoted statement about personal use responsibility and departmental discretion is characteristic of AUP language that governs how employees may use internet and network resources.
Why the other options are wrong
- A. A privacy statement addresses how personal information is handled, not appropriate system usage guidelines.
- B. A remote access policy specifically covers accessing systems from outside the office, not general personal use of internet/intranet systems.
- D. A non-disclosure agreement addresses confidentiality obligations, not personal use of company systems.
Question 20
What is the main problem with relying solely on firewalls to protect your company's sensitive data?
Show answer and explanation
Correct answer: D. Their value is limited because they can be bypassed by technical and non-technical means.
Firewalls are perimeter security devices that protect against external threats reaching internal networks, but they cannot defend against internal threats, insider attacks, or social engineering attacks that bypass technical controls. Additionally, sophisticated attackers can use encrypted tunnels, application-layer attacks, or other techniques to circumvent firewall rules. The fundamental limitation is that firewalls alone provide only one layer of defense and must be combined with other security measures like intrusion detection, encryption, and user awareness training.
Why the other options are wrong
- A. While IDS complements firewalls, the core problem is that firewalls can be bypassed entirely, not just that they lack IDS integration.
- B. Firewall rules can be updated and changed; this is not the main limitation of firewall protection.
- C. Operating system patching is unrelated to firewall effectiveness; firewalls operate at the network layer independent of OS patch status.
Question 21
Which of the following is a characteristic of hash operations?
Show answer and explanation
Correct answer: B. Non-reversible
The primary characteristic of hash operations is that they are non-reversible (one-way functions). Given a hash output, it is computationally infeasible to derive the original input. This property is fundamental to their use in security applications like password storage and data integrity verification.
Why the other options are wrong
- A. Hash functions are neither asymmetric nor symmetric, they are one-way functions distinct from both categories.
- C. Hash operations are not symmetric; symmetric operations are reversible with a key, unlike hashing.
- D. Hash functions produce fixed-length output regardless of input size, not variable length output.
Question 22
What is the command-line tool for Windows XP and later that allows administrators the ability to get or set configuration data for a very wide variety of computer and user account settings?
Show answer and explanation
Correct answer: C. WMIC.EXE
WMIC.EXE (Windows Management Instrumentation Command-line) is a powerful tool that allows administrators to query and modify a wide range of system configuration data, computer settings, and user account properties from the command line on Windows XP and later systems.
Why the other options are wrong
- A. IPCONFIG.EXE is used only for displaying and managing network configuration, not general computer and user account settings.
- B. NETSTAT.EXE displays network statistics and active connections, not general configuration data.
- D. C0NF1G.EXE (with zeros and ones) is not a valid Windows command-line tool.
Question 23
While building multiple virtual machines on a single host operating system, you have determined that each virtual machine needs to work on the network as a separate entity with its own unique IP address on the same logical subnet. You also need to limit each guest operating system to how much system resources it has access to. Which of the following correctly identifies steps that must be taken towards setting up these virtual environments?
Show answer and explanation
Correct answer: C. The virtual machine software must define a separate virtual network interface to each virtual machine as well as how much RAM should be available to each virtual machine.
To meet the requirements, the hypervisor must create separate virtual network interfaces for each VM so they can each have unique IP addresses on the same subnet, and must configure resource limits (such as RAM allocation) for each guest OS. This addresses both the networking requirement (separate network identity) and the resource constraint requirement (limiting access to system resources).
Why the other options are wrong
- A. Hard drive partitions are not mentioned in the requirements; the focus is on network configuration and resource limits.
- B. While separate virtual network interfaces are needed, the statement that they "use the same physical interface" is accurate but doesn't address the resource limitation requirement.
- D. Configuring physical system resources from within the guest OS does not allow the hypervisor to enforce resource limits on the VM.
- E. Each VM does not need a separate physical network interface; virtual network interfaces on a single physical adapter suffice for multiple VMs on the same subnet.
Question 24
You have set up a local area network for your company. Your firewall separates your network into several sections: a DMZ with semi-public servers (web, dns, email) and an intranet with private servers. A penetration tester gains access to both sections and installs sniffers in each. He is able to capture network traffic for all the devices in the private section but only for one device (the device with the sniffer) in the DMZ. What can be inferred about the design of the system?
Show answer and explanation
Correct answer: C. You installed a switch in the private section and a hub in the DMZ
A hub broadcasts all traffic to all ports, allowing a sniffer on any port in that network segment to capture all traffic from all devices on that segment. A switch learns MAC addresses and only forwards frames to specific ports, so a sniffer on one switch port only sees traffic destined for that port. The private section allows capture of all traffic (hub behavior), while the DMZ only allows capture on the sniffer's device (switch behavior). Therefore, a hub is in the private section and a switch is in the DMZ.
Why the other options are wrong
- A. A router would segment networks and prevent the sniffer from capturing all private network traffic.
- B. A hub in the private section is correct, but a switch in the DMZ is correct, this reverses the network topology.
- D. A router in the DMZ would further segment traffic and not match the observed behavior.
Question 25
Which of the following TCP dump output lines indicates the first step in the TCP 3-way handshake?
Show answer and explanation
Correct answer: A. 07:09:43.368615 download.net 39904 > ftp.com.21: S 733381829:733381829(0) win 8760 <mss 1460> (DF)
Option A shows the SYN flag (S) being sent from the client (download.net:39904) to the server (ftp.com:21), which is the first step of the TCP three-way handshake. The client initiates the connection with a synchronization packet containing an initial sequence number, indicated by 'S' in the tcpdump output.
Why the other options are wrong
- B. This shows the SYN-ACK response (second step) from the server back to the client.
- C. This shows a reset packet (RST), which is not part of the normal three-way handshake sequence.
- D. This shows an ACK packet (third step) sent by the client, completing the handshake rather than initiating it.
Question 26
In preparation to do a vulnerability scan against your company's systems. You've taken the steps below: You've notified users that there will be a system test. You've priontized and selected your targets and subnets. You've configured the system to do a deep scan. You have a member of your team on call to answer questions. Which of the following is a necessary step to take prior to starting the scan?
Show answer and explanation
Correct answer: C. Getting permission to run the scan.
Before conducting any vulnerability scan against company systems, explicit written permission must be obtained from appropriate management and stakeholders. This is a critical legal and organizational requirement to ensure the scan is authorized and to avoid potential liability. Without documented authorization, vulnerability scanning could be considered unauthorized system access or testing, which has serious legal and employment consequences.
Why the other options are wrong
- A. While incident response readiness is good practice, explicit incident response team activation is not a prerequisite for a planned, scheduled vulnerability scan.
- B. Clearing system logs before a scan would destroy evidence and audit trails; logs should be preserved and reviewed after the scan.
- D. The timing relative to OS updates is a operational consideration, not a necessary prerequisite step before starting a scan.
Question 27
You have reason to believe someone with a domain user account has been accessing and modifying sensitive spreadsheets on one of your application servers. You decide to enable auditing for the files to see who is accessing and changing them. You enable the Audit Object Access policy on the files via Group Policy. Two weeks later, when you check on the audit logs, you see they are empty. What is the most likely reason this has happened?
Show answer and explanation
Correct answer: B. You did not enable auditing on the files
Enabling the Audit Object Access GPO policy is only half the requirement. Individual files and folders must also have specific SACL (System Access Control List) entries configured to generate audit events when accessed. Without setting these file-level audit settings, the policy alone produces no logs. The most likely reason for empty audit logs is that auditing was not properly enabled on the actual files themselves.
Why the other options are wrong
- A. Auditing can be enabled on individual files, not just folders.
- C. Domain users typically lack permissions to disable system auditing policies.
- D. If changes weren't saved, GPO would not have applied at all.
Question 28
Which of the following systems acts as a NAT device when utilizing VMware in NAT mode?
Show answer and explanation
Correct answer: C. Host system
In VMware NAT mode, the host system acts as the NAT device, translating network addresses between the guest virtual machines and the external network. The host system performs the address translation, allowing guest systems to communicate with external networks while appearing to use the host's address.
Why the other options are wrong
- A. Guest systems do not perform NAT; they are behind the NAT device.
- B. Local gateway is not the component performing NAT in VMware NAT mode.
- D. Virtual system is too vague; the host system specifically performs the NAT function.
Question 29
Your organization has broken its network into several sections/segments, which are separated by firewalls, ACLs and VLANs. The purpose is to defend segments of the network from potential attacks that originate in a different segment or that attempt to spread across segments. This style of defense-in-depth protection is best described as which of the following?
Show answer and explanation
Correct answer: B. Protected enclaves
Protected enclaves describes a network architecture where different segments are isolated and protected from one another using firewalls, ACLs, and VLANs. This approach creates distinct security zones or enclaves, preventing lateral movement of attacks across the network and defending specific segments from threats originating elsewhere.
Why the other options are wrong
- A. Uniform protection applies the same defense mechanisms to all devices equally without segmentation.
- C. Vector-oriented is not a standard defense-in-depth terminology.
- D. Information-centric focuses on protecting data assets specifically rather than network segmentation.
Question 30
Which of the following statements about policy is FALSE?
Show answer and explanation
Correct answer: B. A well-written policy states the specifics of "how" to do something.
A well-written security policy should establish the 'what' (objectives and requirements) but should not prescribe specific 'how' details, as those belong in procedures and technical standards that change more frequently. Policy provides high-level direction; implementation details are separated into procedures. Options A, C, and D accurately describe policy functions: defining what must be done, protecting information, and protecting compliant employees from liability.
Why the other options are wrong
- A. Well-written policies correctly define 'what' objectives and requirements.
- C. Security policy appropriately establishes what must be done to protect information.
- D. Policy protects good-faith employees by establishing clear guidelines to follow.
Question 31
A folder D:\Files\Marketing has the following NTFS permissions: Administrators: Full Control Marketing: Change and Authenticated Users: Read It has been shared on the server as "MARKETING", with the following share permissions: Full Control share permissions for the Marketing group Which of the following effective permissions apply if a user from the Sales group accesses the \\FILESERVER\MARKETING shared folder?
Show answer and explanation
Correct answer: C. Read
Effective permissions are determined by the most restrictive combination of NTFS and share permissions. A Sales user is not explicitly listed in NTFS permissions (not Administrators or Marketing), so they fall under Authenticated Users with Read permission. The share permission for Marketing group doesn't apply to Sales users. The intersection of NTFS Read (for Authenticated Users) and share permissions results in Read access being the effective permission.
Why the other options are wrong
- A. No access is incorrect; Authenticated Users have Read NTFS permission.
- B. Full Control requires explicit Full Control in both NTFS and share permissions, which Sales doesn't have.
- D. Change requires Change permission in NTFS, which Authenticated Users don't have.
Question 32
Which of the below choices should an organization start with when implementing an effective risk management process?
Show answer and explanation
Correct answer: B. Define security policy requirements
Defining security policy requirements should be the starting point for implementing an effective risk management process. Security policies provide the foundation and framework for all subsequent risk management activities, including identifying risks, implementing controls, and conducting reviews. Without defined policies, there is no clear direction for the entire program.
Why the other options are wrong
- A. Incident response planning comes after establishing the foundational security policies and risk management framework.
- C. Periodic reviews are conducted throughout the process to assess ongoing effectiveness, not at the beginning.
- D. Designing controls and standards depends on first having security policies and understanding organizational risks.
Question 33
What is the function of the TTL (Time to Live) field in IPv4 and the Hop Limit field in IPv6 In an IP Packet header?
Show answer and explanation
Correct answer: A. These fields are decremented each time a packet is retransmitted to minimize the possibility of routing loops.
The TTL (Time to Live) field in IPv4 and the Hop Limit field in IPv6 are decremented by one each time a packet passes through a router. When the field reaches zero, the packet is discarded. This mechanism prevents packets from circulating indefinitely in routing loops and ensures that misconfigured routing does not cause infinite packet circulation.
Why the other options are wrong
- B. TTL/Hop Limit fields are unrelated to fragmentation prevention; fragmentation is controlled by the Don't Fragment flag and MTU discovery.
- C. These fields are not recalculated based on destination arrival time; they simply decrement at each hop regardless of timing.
- D. These fields are decremented, not incremented; and they count hops remaining, not hops traversed.
Question 34
Which of the following is the FIRST step in performing an Operational Security (OP5EC) Vulnerabilities Assessment?
Show answer and explanation
Correct answer: E. Identification of critical information
The Operational Security (OPSEC) vulnerability assessment process begins with identification of critical information. Without first determining what information is critical to protect, the subsequent steps of assessing threats, vulnerabilities, risks, and countermeasures lack proper focus and context. This foundational step ensures the assessment addresses the organization's most valuable and sensitive assets.
Why the other options are wrong
- A. Threat assessment comes after identifying critical information, as you must know what to protect before assessing threats against it.
- B. Assessing vulnerabilities requires first knowing which critical information needs protection.
- C. Risk analysis cannot be properly conducted without first identifying critical information.
- D. Implementing countermeasures is the final step, not the first; it follows assessment and analysis phases.
Question 35
An attacker gained physical access to an internal computer to access company proprietary data. The facility is protected by a fingerprint biometric system that records both failed and successful entry attempts. No failures were logged during the time periods of the recent breach. The account used when the attacker entered the facility shortly before each incident belongs to an employee who was out of the area. With respect to the biometric entry system, which of the following actions will help mitigate unauthorized physical access to the facility?
Show answer and explanation
Correct answer: B. Try to lower the False Accept Rate (FAR)
The False Accept Rate (FAR) represents the probability that an unauthorized person is incorrectly accepted by the biometric system. Lowering the FAR reduces the likelihood of unauthorized access, which directly addresses the breach where an attacker apparently bypassed the fingerprint biometric system. This tuning increases security by making the system more strict about accepting matches.
Why the other options are wrong
- A. Raising the CER (Crossover Error Rate) would make the system less accurate overall, increasing both false accepts and false rejects.
- C. Setting EER to zero is theoretically impossible in practice and does not directly address the authorization bypass problem.
- D. Lowering the FRR (False Reject Rate) would make the system more lenient, actually increasing the risk of false accepts and unauthorized access.
Question 36
Regarding the UDP header below, what is the length in bytes of the UDP datagrarn? 04 1a 00 a1 00 55 db 51
Show answer and explanation
Correct answer: D. 85
The UDP header contains a length field at bytes 4-5 (the third 16-bit word). In the given header 04 1a 00 a1 00 55 db 51, the length field is '00 55' which equals 0x0055 in hexadecimal, converting to 85 in decimal. This length includes both the UDP header (8 bytes) and the data payload.
Why the other options are wrong
- A. 161 (0xa1) appears in the header but is not the length field value.
- B. 81 is not the correct hexadecimal to decimal conversion of the length field.
- C. 219 (0xdb) appears later in the header but is not the UDP length field.
Question 37
The following three steps belong to the chain of custody for federal rules of evidence. What additional step is recommended between steps 2 and 3? STEP 1 - Take notes: who, what, where, when and record serial numbers of machine(s) in question. STEP 2 - Do a binary backup if data is being collected. STEP 3 - Deliver collected evidence to law enforcement officials.
Show answer and explanation
Correct answer: D. Check the backup integrity using a checksum utility like MD5, and sign and seal each piece of collected evidence in a plastic bag.
Between creating a binary backup (step 2) and delivering evidence to law enforcement (step 3), the integrity of that backup must be verified using cryptographic checksums like MD5 or SHA-1 to ensure no data corruption occurred. Additionally, each piece of evidence must be properly signed, sealed, and documented to maintain chain of custody integrity and admissibility in court.
Why the other options are wrong
- A. Rebuilding the original hard drive defeats the purpose of preserving original evidence and is not a standard chain of custody step.
- B. Forensic analysis should occur after establishing chain of custody, not before, to maintain evidence integrity and legal admissibility.
- C. Photographing persons with access is not a standard step between backup creation and delivery to law enforcement.
Question 38
A US case involving malicious code is brought to trial. An employee had opened a helpdesk ticket to report specific instances of strange behavior on her system. The IT helpdesk representative collected information by interviewing the user and escalated the ticket to the system administrators. As the user had regulated and sensitive data on her computer, the system administrators had the hard drive sent to the company's forensic consultant for analysis and configured a new hard drive for the user. Based on the recommendations from the forensic consultant and the company's legal department, the CEO decided to prosecute the author of the malicious code. During the court case, which of the following would be able to provide direct evidence?
Show answer and explanation
Correct answer: C. The user of the infected system
The user of the infected system can provide direct evidence about her own experience with the malicious code and the strange behavior she observed, as she has firsthand knowledge of the system's behavior. Direct evidence is testimony based on personal observation or knowledge.
Why the other options are wrong
- A. The helpdesk representative can only provide indirect evidence about what the user reported, not direct observation of the malware's effects.
- B. The CEO providing testimony about recommendations and decisions would be indirect evidence, not direct evidence of the malicious code's behavior.
- D. The system administrator who removed the hard drive is a witness to chain of custody and handling procedures, not someone with direct evidence about the malware's operation.
Question 39
Which of the following is a required component for successful 802.lx network authentication?
Show answer and explanation
Correct answer: A. Supplicant
The Supplicant is a required component of 802.1X network authentication. It is the software or device (client) that authenticates to the network by requesting access and responding to authentication challenges from the authenticator (network switch or access point).
Why the other options are wrong
- B. While a Certificate Authority may be used in some 802.1X implementations, it is not a required component for all 802.1X deployments.
- C. A Ticket Granting Server belongs to Kerberos authentication, not 802.1X.
- D. IPSec is a network security protocol unrelated to the core components required for 802.1X authentication.
Question 40
How is a Distributed Denial of Service (DDOS) attack distinguished from a regular DOS attack?
Show answer and explanation
Correct answer: A. DDOS attacks are perpetrated by many distributed hosts.
A Distributed Denial of Service (DDoS) attack is distinguished from a regular DOS attack by the source of the attack traffic. DDoS attacks originate from multiple distributed hosts or systems (often a botnet), whereas a standard DOS attack typically comes from a single source. This distributed nature makes DDoS attacks significantly harder to mitigate.
Why the other options are wrong
- B. DDoS attacks target a single victim system, not multiple distributed targets.
- C. Regular DOS attacks can target any network device, not just routers.
- D. DDoS attacks do not affect the entire Internet; they target specific victim systems or networks.
Question 41
What is the main reason that DES is faster than RSA?
Show answer and explanation
Correct answer: D. Symmetric cryptography is generally much faster than asymmetric.
Symmetric cryptography (such as DES) is generally much faster than asymmetric cryptography (such as RSA) because symmetric algorithms use simpler mathematical operations and shorter key lengths relative to their security strength. Asymmetric cryptography requires complex mathematical operations like modular exponentiation on very large numbers, making it inherently slower. This is why symmetric encryption is used for bulk data encryption and asymmetric encryption is used for key exchange and signatures.
Why the other options are wrong
- A. Security level does not determine speed; many secure algorithms can be fast or slow depending on their mathematical basis.
- B. Implementation medium (hardware vs software) is not the primary reason; the algorithmic difference between symmetric and asymmetric is fundamental.
- C. This is backwards; asymmetric cryptography is actually much slower than symmetric cryptography.
Question 42
Why would someone use port 80 for deployment of unauthorized services?
Show answer and explanation
Correct answer: D. HTTP traffic is usually allowed outbound to port 80 through the firewall in most environments.
Port 80 is used for unauthorized services because HTTP traffic on port 80 is typically allowed outbound through firewalls in most environments. Attackers leverage this allowed traffic to bypass firewall restrictions and establish communication channels for malicious services. This is a common evasion technique exploiting trusted protocols and ports.
Why the other options are wrong
- A. Google does not automatically detect and post links to services on port 80; this is not a realistic reason for targeting this port.
- B. Random browsing to a rogue port 80 service might expose vulnerabilities, but this is not the primary reason for using port 80 for deployment.
- C. Using port 80 is not a technique for performing denial of service; DoS attacks use different methods and not specifically port 80.
Question 43
What is the first thing that should be done during the containment step of incident handling?
Show answer and explanation
Correct answer: B. Secure the area
During the containment phase of incident handling, securing the area is the foundational first step to prevent further compromise, preserve evidence, and control access. This must occur before other actions like password changes, which could alter evidence, or notifications that might alert the threat actor. Jump bag preparation is a pre-incident activity, and reporting occurs after investigation.
Why the other options are wrong
- A. Changing passwords could alter evidence and should not be done before securing the area and assessing the incident.
- C. Preparing the jump bag is a pre-incident preparation activity, not part of active incident containment.
- D. Management notification typically occurs after initial containment and assessment, not as the first containment action.
- E. Reporting is completed after investigation and analysis, not during the initial containment phase.
Question 44
Which aspect of UNIX systems was process accounting originally developed for?
Show answer and explanation
Correct answer: B. Time sharing
Process accounting on UNIX systems was originally developed to track resource usage in time-sharing environments, where multiple users shared a single computer system and billing/resource allocation needed to be tracked per user and per process. This capability allowed administrators to monitor who was using what resources and for how long.
Why the other options are wrong
- A. Data warehouses are modern database concepts not related to the original purpose of UNIX process accounting.
- C. While process accounting does enable process tracking, the original specific purpose was for time-sharing system management and billing.
- D. Real-time systems are a separate class of computing; process accounting was not developed for real-time requirements.
Question 45
Which Defense-in-Depth principle starts with an awareness of the value of each section of information within an organization?
Show answer and explanation
Correct answer: A. Information centric defense
Information-centric defense is a defense-in-depth approach that classifies and prioritizes information based on its value and sensitivity to the organization, then applies appropriate protection layers accordingly. This principle recognizes that not all information has equal value and requires customized protection strategies based on organizational assets.
Why the other options are wrong
- B. Uniform information protection applies the same security controls to all information regardless of value, which contradicts the value-awareness principle.
- C. General information protection is not a recognized defense-in-depth principle and is too vague.
- D. Perimeter layering focuses on network boundary protection, not on classification based on information value.
Question 46
Which of the following is a new Windows Server 2008 feature for the Remote Desktop Protocol (RDP)?
Show answer and explanation
Correct answer: D. The ability to allow clients to execute individual applications rather than using a terminal desktop
Windows Server 2008 introduced RemoteApp, which allows clients to execute and interact with individual applications remotely rather than connecting to an entire terminal desktop session. This provides a more seamless user experience by making remote applications appear as if they're running locally. Option A (custom RDP ports) predates 2008, Option B (mobile device support) was limited in 2008, and Option C (TLS authentication) was also present in earlier versions.
Why the other options are wrong
- A. Custom RDP port configuration was available in earlier Windows Server versions, not new to 2008.
- B. Mobile device support for RDP was extremely limited in Windows Server 2008 and not a primary feature.
- C. TLS/SSL support for RDP connections existed prior to Windows Server 2008.
Question 47
Who is responsible for deciding the appropriate classification level for data within an organization?
Show answer and explanation
Correct answer: D. Data owner
The data owner is responsible for deciding the appropriate classification level for data. Data owners have authority over their data assets and make decisions about sensitivity levels, access restrictions, and protection requirements. Custodians implement and maintain the protections decided by owners, security auditors verify compliance, and end users follow established policies.
Why the other options are wrong
- A. Data custodians implement and maintain security measures but do not decide classification levels.
- B. Security auditors verify that data is properly classified and protected; they do not make initial classification decisions.
- C. End users follow the classification policies established by data owners and do not determine classification levels.
Question 48
Which of the following fields CANNOT be hashed by Authentication Header (AH) in transport mode?
Show answer and explanation
Correct answer: C. TTL
In IPsec AH transport mode, the TTL (Time To Live) field cannot be hashed because it changes during transit as packets hop through routers. Hashing a field that changes in transit would cause the integrity check to fail at the destination. The Length field (A), Source IP (B), and Destination IP (D) remain constant during transport and can be reliably hashed.
Why the other options are wrong
- A. Length field can be hashed as it remains constant during transport.
- B. Source IP address can be hashed as it remains constant during transport.
- D. Destination IP address can be hashed as it remains constant during transport.
Question 49
How many bytes does it take to represent the hexadecimal value OxFEDCBA?
Show answer and explanation
Correct answer: C. 3
The hexadecimal value 0xFEDCBA contains 6 hexadecimal digits. Since each hexadecimal digit represents 4 bits, and 8 bits equal 1 byte, 6 hex digits equal 3 bytes (6 digits ÷ 2 = 3 bytes). The value breaks down as: FE (1 byte), DC (1 byte), BA (1 byte).
Why the other options are wrong
- A. 12 bytes would represent 24 hexadecimal digits, not 6.
- B. 2 bytes would only represent 4 hexadecimal digits.
- D. 6 bytes would represent 12 hexadecimal digits.
Question 50
What does an attacker need to consider when attempting an IP spoofing attack that relies on guessing Initial Sequence Numbers (ISNs)?
Show answer and explanation
Correct answer: A. These attacks work against relatively idle servers.
IP spoofing attacks that rely on guessing Initial Sequence Numbers (ISNs) work best against relatively idle servers because the attacker must correctly predict the next sequence number in the TCP stream. With idle servers that have longer gaps between legitimate connections, the attacker has more time to attempt the guess without being discovered by timing anomalies or competing legitimate traffic.
Why the other options are wrong
- B. These attacks do not require a modified TCP/IP stack; they exploit the predictability of sequence numbers in the standard TCP protocol.
- C. These attacks are actually difficult to trace because the source IP is spoofed, making attribution challenging.
- D. IP spoofing attacks work against any operating system that implements TCP/IP, not just Linux/Unix hosts.
Question 51
What is the following sequence of packets demonstrating?
Show answer and explanation
Correct answer: C. client.com.38060 > telnet.com.telnet: F 92:92(0) ack 4290 win 8760 (DF)
This packet sequence demonstrates a normal TCP connection termination (graceful close). Packet C shows the client sending a FIN (finish) flag with sequence number 92 and acknowledging sequence 4290, which initiates the client's side of the connection closure. This is followed by the server's acknowledgment in packet D, completing a standard four-way TCP handshake for connection termination. Packet A shows the server sending its own FIN, and packet B shows the client's acknowledgment of that FIN.
Why the other options are wrong
- A. This packet shows the server's FIN flag, which is part of the termination sequence but comes after the client initiates the close.
- B. This is just an acknowledgment packet; it does not demonstrate the full termination sequence.
- D. This is the server's acknowledgment of the client's FIN flag; it completes the sequence but is not the initiating packet of the demonstration.
Question 52
Which Linux file lists every process that starts at boot time?
Show answer and explanation
Correct answer: D. inittab
The `inittab` file in Linux is the configuration file read by the init process during boot. It specifies which processes and services start at boot time and how the system transitions between runlevels. This is the standard initialization table that controls the startup sequence in traditional System V-style init systems. While `initd` (init.d) contains the actual startup scripts, `inittab` is the file that lists/configures what starts at boot time.
Why the other options are wrong
- A. The `inetd` daemon manages internet services, not boot-time process initialization.
- B. The `netsrv` file is not a standard Linux component for process startup configuration.
- C. The `initd` directory contains startup scripts, but `inittab` is the configuration file that specifies which processes start at boot.
Question 53
Which class of IDS events occur when the IDS fails to alert on malicious data?
Show answer and explanation
Correct answer: D. False Negative
A False Negative occurs when the IDS fails to detect and alert on malicious data that is actually present. This is the most critical failure mode of an IDS because malicious traffic passes through undetected. True positives correctly identify attacks, true negatives correctly identify legitimate traffic, and false positives incorrectly flag legitimate traffic as malicious.
Why the other options are wrong
- A. True Negative refers to correctly identifying legitimate (non-malicious) traffic and not alerting.
- B. True Positive refers to correctly detecting actual malicious data and alerting appropriately.
- C. False Positive refers to incorrectly alerting on legitimate traffic as if it were malicious.
Question 54
What file instructs programs like Web spiders NOT to search certain areas of a site?
Show answer and explanation
Correct answer: A. Robots.txt
The robots.txt file is the standard text file placed in a website's root directory that provides instructions to web crawlers and spiders about which areas of the site should or should not be accessed. Search engines and web spiders consult this file to respect website owners' preferences. The other filenames (Restricted.txt, Spider.txt, Search.txt) are not recognized standards in web protocol specifications.
Why the other options are wrong
- B. Restricted.txt is not a recognized standard file for controlling web crawler access.
- C. Spider.txt is not the standard filename; the actual standard is robots.txt.
- D. Search.txt is not a recognized standard for instructing search engines or spiders.
Question 55
During which of the following steps is the public/private key-pair generated for Public Key Infrastructure (PKI)?
Show answer and explanation
Correct answer: B. Initialization
During the Initialization phase of PKI, the public/private key-pair is generated for an entity. This is the first step in establishing a user's cryptographic identity before registration with a Certificate Authority.
Why the other options are wrong
- A. Key Recovery is a later phase used to restore compromised or lost keys, not to generate the initial key-pair.
- C. Registration occurs after initialization, when the entity submits their public key and identity information to the CA.
- D. Certification is when the CA issues a digital certificate binding the public key to the entity's identity.
Question 56
IPS devices that are classified as "In-line NIDS" devices use a combination of anomaly analysis, signature-based rules, and what else to identify malicious events on the network?
Show answer and explanation
Correct answer: B. Application analysis
In-line NIDS/IPS devices use three primary detection methodologies: signature-based rules (matching known attack patterns), anomaly analysis (detecting deviations from normal behavior), and application analysis (understanding and inspecting application-layer protocols and behavior). Application analysis helps identify sophisticated attacks that operate at the application layer.
Why the other options are wrong
- A. Firewall compatibility rules are not a detection methodology used by IPS devices.
- C. ICMP and UDP active scanning describes offensive reconnaissance techniques, not IPS detection methods.
- D. MAC address filtering is a Layer 2 access control mechanism, not part of IPS malicious event detection.
Question 57
Validating which vulnerabilities in a network environment are able to be exploited by an attacker is called what?
Show answer and explanation
Correct answer: D. Penetration testing
Penetration testing actively attempts to exploit vulnerabilities to determine which ones are actually exploitable in the network environment. Vulnerability scanning identifies potential vulnerabilities but does not confirm exploitability; penetration testing goes further by validating which vulnerabilities can realistically be leveraged by attackers, providing a practical assessment of actual risk.
Why the other options are wrong
- A. Anomaly detection identifies unusual network behavior, not which vulnerabilities are exploitable.
- B. Vulnerability scanning identifies weaknesses but does not validate whether they are actually exploitable.
- C. Perimeter assessment is a general term for boundary review; it does not specifically validate exploitability of vulnerabilities.
Question 58
Which layer of the TCP/IP Protocol Stack Is responsible for port numbers?
Show answer and explanation
Correct answer: B. Transport
Port numbers are managed at the Transport Layer of the TCP/IP stack. This layer includes protocols like TCP and UDP, which use port numbers to identify specific services and applications on a host. Ports enable multiplexing of multiple applications over the same network connection.
Why the other options are wrong
- A. The Network Layer (IP) handles routing and logical addressing, not port numbers.
- C. The Internet Layer is synonymous with the Network Layer and does not manage port numbers.
- D. The Application Layer uses ports but does not manage them; port management is a Transport Layer function.
Question 59
What would the following IP tables command do? IP tables -I INPUT -s 99.23.45.1/32 -j DROP
Show answer and explanation
Correct answer: A. Drop all packets from the source address
The command 'iptables -I INPUT -s 99.23.45.1/32 -j DROP' inserts (-I) a rule into the INPUT chain that matches packets from the source (-s) address 99.23.45.1 and applies the DROP action (-j DROP) to them. This drops all incoming packets originating from that specific source address. The /32 indicates a single host. Option B incorrectly describes the action as 'input,' option C mentions logging which isn't part of this command, and option D is incorrect because the rule targets source addresses, not destination addresses.
Why the other options are wrong
- B. The command drops packets; it does not input or forward them to the source address.
- C. This command uses DROP action, not LOG; no logging occurs without explicit -j LOG specification.
- D. The -s flag specifies source address filtering, not destination; packets are dropped based on origin.
Question 60
How are differences in configuration settings handled between Domain and Local Group Policy Objects (GPOs)?
Show answer and explanation
Correct answer: B. Settings in the domain-wide GPO override conflicting settings in the local GPO on each computer.
In Windows Group Policy processing, domain-wide GPO settings override conflicting local GPO settings. This follows the standard GPO precedence order: Local Group Policy is applied first, then Site, Domain, and Organizational Unit GPOs in sequence, with later policies overriding earlier ones when conflicts exist.
Why the other options are wrong
- A. Domain and Local GPOs can control overlapping settings, creating potential conflicts that must be resolved.
- C. Local GPO settings do not override domain GPO settings; domain policies have higher precedence.
- D. GPO precedence is based on the hierarchy and scope, not on which was updated first.
Question 61
When discussing access controls, which of the following terms describes the process of determining the activities or functions that an Individual is permitted to perform?
Show answer and explanation
Correct answer: C. Authorization
Authorization is the process of determining what actions, permissions, and functions an authenticated user or entity is allowed to perform. It answers the question 'what can this user do?' after they have been identified and authenticated.
Why the other options are wrong
- A. Authentication is the process of verifying identity (proving you are who you claim to be), not determining what activities are permitted.
- B. Identification is simply claiming or stating an identity, not determining what permissions are granted.
- D. Validation refers to confirming the correctness or integrity of data, not defining user permissions.
Question 62
Which of the following would be a valid reason to use a Windows workgroup?
Show answer and explanation
Correct answer: A. Lower initial cost
A valid reason to use a Windows workgroup is lower initial cost. Workgroups are peer-to-peer networks that require no dedicated domain controller, directory services infrastructure, or licensing costs associated with Active Directory domains. This makes them appropriate for small organizations or temporary networks where the cost of domain infrastructure is not justified. The other options describe advantages of domains, not workgroups.
Why the other options are wrong
- B. Single sign-on (SSO) is a domain feature, not a workgroup feature; workgroups require separate authentication at each resource.
- C. Centralized control is provided by Active Directory domains, not workgroups, which use distributed peer-to-peer management.
- D. Consistent permissions and rights management is a domain feature; workgroups do not provide centralized policy enforcement.
Question 63
Which of the following is TRUE regarding the ability of attackers to eavesdrop on wireless communications?
Show answer and explanation
Correct answer: B. Eavesdropping attacks can take place from miles away.
Wireless eavesdropping attacks can potentially be conducted from considerable distances depending on transmitter power, antenna gain, and environmental conditions. Modern wireless networks can be intercepted from distances significantly beyond typical building range. Options A, C, and D are factually incorrect: concrete walls do not prevent all eavesdropping (signals penetrate or bypass), eavesdropping is difficult to detect passively, and basic eavesdropping tools are inexpensive or free.
Why the other options are wrong
- A. Wireless signals penetrate concrete walls and can be intercepted through barriers.
- C. Passive eavesdropping is inherently difficult to detect on wireless networks.
- D. Many eavesdropping tools like Wireshark are free or cost very little.
Question 64
There are three key factors in selecting a biometric mechanism. What are they?
Show answer and explanation
Correct answer: C. Reliability, user acceptance, and cost
The three key factors in selecting a biometric mechanism are reliability (false acceptance and rejection rates), user acceptance (willingness to use the system), and cost (implementation and operational expenses). These factors balance the technical performance, practical usability, and financial viability of any biometric authentication system. Encryption strength is not a primary selection factor for biometrics since the strength of biometric systems depends on the accuracy of the matching algorithm, not cryptographic encryption.
Why the other options are wrong
- A. Encryption strength is not a primary biometric selection factor; reliability, acceptance, and cost are the key considerations.
- B. Encryption strength and authorization method are not among the three key biometric selection factors.
- D. Encryption strength is not a relevant selection factor for biometric mechanisms; the correct factors are reliability, user acceptance, and cost.
Question 65
The Return on Investment (ROI) measurement used in Information Technology and Information Security fields is typically calculated with which formula?
Show answer and explanation
Correct answer: A. ROI = (gain - expenditure)/(expenditure) X 100%
ROI is calculated as the net gain (or loss) divided by the initial expenditure, expressed as a percentage. The formula (Gain - Expenditure) / Expenditure × 100% shows the return earned per dollar invested, which is the standard financial metric for evaluating investment effectiveness.
Why the other options are wrong
- B. Adding gain and expenditure instead of subtracting does not produce a valid ROI measurement.
- C. Using loss in the numerator with addition produces a meaningless metric that contradicts ROI principles.
- D. Using loss instead of gain produces a negative metric that does not represent return on investment.
Question 66
One of your Linux systems was compromised last night. According to change management history and a recent vulnerability scan, the system's patches were up-to-date at the time of the attack. Which of the following statements is the Most Likely explanation?
Show answer and explanation
Correct answer: A. It was a zero-day exploit.
A zero-day exploit is the most likely explanation when a fully patched system is compromised. Zero-day exploits target previously unknown vulnerabilities for which no patches exist, so current patches cannot defend against them. Trojans (B) typically arrive through user action. Worms (C) spread through known vulnerabilities. Man-in-the-middle (D) attacks are network-based interception attacks, not system compromises due to unpatched vulnerabilities.
Why the other options are wrong
- B. Trojans require user interaction or social engineering to be installed, and wouldn't bypass patching.
- C. Worms exploit known vulnerabilities, which would be patched on an up-to-date system.
- D. Man-in-the-middle attacks intercept communications but don't compromise systems through unpatched vulnerabilities.
Question 67
Which of the following is an Implementation of PKI?
Show answer and explanation
Correct answer: A. SSL
SSL (Secure Sockets Layer) is a cryptographic protocol that implements Public Key Infrastructure (PKI) principles using digital certificates, certificate authorities, and public/private key pairs for secure communications. 3DES is a symmetric encryption algorithm. Kerberos is an authentication protocol using symmetric keys. SHA-1 is a hash function. Only SSL implements the full PKI framework with certificate-based authentication and key management.
Why the other options are wrong
- B. 3DES is a symmetric encryption algorithm, not a PKI implementation.
- C. Kerberos uses symmetric cryptography and ticket-based authentication, not PKI.
- D. SHA-1 is a cryptographic hash function, not a PKI implementation.
Question 68
A new data center is being built where customer credit information will be processed and stored. Which of the following actions will help maintain the confidentiality of the data?
Show answer and explanation
Correct answer: B. Access control system for physical building
An access control system for the physical building prevents unauthorized individuals from physically accessing the data center where customer credit information is stored and processed. Physical access controls are a foundational element of confidentiality protection, as they prevent direct unauthorized access to systems containing sensitive data.
Why the other options are wrong
- A. Environmental sensors monitor temperature and humidity but do not protect data confidentiality; they protect system availability and integrity.
- C. Fire detection and control systems protect data availability and system continuity but do not directly maintain confidentiality.
- D. Frequent off-site backups protect data availability and recovery but do not maintain confidentiality of data in the primary data center.
Question 69
Which common firewall feature can be utilized to generate a forensic trail of evidence and to identify attack trends against your network?
Show answer and explanation
Correct answer: C. Logging
Logging is the firewall feature that records network traffic and security events, creating a forensic trail of evidence that can be analyzed to identify attack patterns and trends. Logs capture detailed information about connections, blocked traffic, and suspicious activities that are essential for forensic analysis and trend identification.
Why the other options are wrong
- A. NAT translates addresses but does not inherently generate forensic evidence trails.
- B. State tables track active connections but are not primarily designed for forensic analysis or trend identification.
- D. Content filtering blocks certain content but does not create the detailed forensic trail needed for evidence and trend analysis.
Question 70
You have an automated system for patching the operating systems of all your computers. All patches are supposedly current. Yet your automated vulnerability scanner has just reported vulnerabilities that you believe have been patched. Which of the actions below should you take next?
Show answer and explanation
Correct answer: A. Check some systems manually.
When automated systems report unexpected vulnerabilities despite patching, the first logical step is to manually verify some systems to determine if the vulnerability scanner has false positives or if patches failed to apply correctly. This provides direct evidence about what is actually occurring.
Why the other options are wrong
- B. Rerunning patching without first investigating could waste resources if patches are already applied, and doesn't address whether the scanner is reporting accurately.
- C. Contacting incident response before investigating would be premature, as this may not be a security incident, it could be a scanner false positive or verification issue.
- D. Ignoring the findings without investigation is irresponsible and violates proper vulnerability management procedures; the discrepancy must be resolved.
That was 70 of 279.
The full GIAC Security Essentials GSEC pack has all 279 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 139 free as one PDF by email. Get the Half Pack →