10 free GIAC Security Essentials GSEC practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 279 questions. Work through them, then open each answer to check your reasoning.
Get all 279 questions (US$39) · Download these 10 as a PDF
Question 1
Which of the following protocols is used by a host that knows its own MAC (Media Access Control) address to query a server for its own IP address?
Show answer and explanation
Correct answer: A. RARP
RARP (Reverse Address Resolution Protocol) is specifically designed for a host to discover its own IP address when it knows its MAC address. A host with a known MAC address sends a RARP request to obtain the corresponding IP address from a RARP server.
Why the other options are wrong
- B. ARP does the opposite, it resolves IP addresses to MAC addresses, not MAC to IP.
- C. DNS resolves domain names to IP addresses, not MAC addresses to IP addresses.
- D. RDNS (Reverse DNS) performs reverse lookups of IP addresses to domain names, not MAC to IP resolution.
Question 2
What is the motivation behind SYN/FIN scanning?
Show answer and explanation
Correct answer: C. The crafted SYN/FIN packet sometimes gets past firewalls and filtering routers.
SYN/FIN scanning exploits the unusual combination of flags (SYN and FIN set simultaneously) to craft packets that may evade firewall rules and filtering routers. Many firewalls are configured to block standard connection attempts but may not properly handle or filter these non-standard packet combinations, allowing them to pass through.
Why the other options are wrong
- A. SYN/FIN packets are not a standard signaling mechanism for Trojans.
- B. While SYN floods are used in DoS attacks, SYN/FIN combinations are not a typical DoS vector, nor are they specifically targeted at BSD hosts.
- D. Session hijacking uses sequence number prediction and packet injection, not SYN/FIN scanning techniques.
Question 3
There is not universal agreement on the names of the layers in the TCP/IP networking model.
Which of the following is one of the functions of the bottom layer which is sometimes called the Network Access or Link Layer?
Show answer and explanation
Correct answer: D. Defines the procedures for interfacing with Ethernet devices
The Network Access or Link Layer (the bottom layer of the TCP/IP model) handles the physical transmission of data and defines how devices interface with network hardware. This includes procedures for interfacing with Ethernet devices, managing MAC addresses, and handling physical frame transmission.
Why the other options are wrong
- A. This is a function of the Transport or Application layer, which provides end-to-end services for applications.
- B. Routing is performed at the Internet layer, not the Link layer.
- C. IP addressing is an Internet layer function, and encryption can occur at multiple layers but is not a primary Link layer responsibility.
Question 4
Which of the following is a private, RFC 1918 compliant IP address that would be assigned to a DHCP scope on a private LAN?
Show answer and explanation
Correct answer: C. 10.254.1.50
RFC 1918 defines three ranges of private IP addresses: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The address 10.254.1.50 falls within the 10.0.0.0/8 range and is a valid private address suitable for DHCP assignment on a private LAN.
Why the other options are wrong
- A. 127.0.0.100 is a loopback address, not a private RFC 1918 address.
- B. 169.254.1.50 is in the link-local range (169.254.0.0/16), not an RFC 1918 private range.
- D. 172.35.1.100 falls outside the RFC 1918 private range of 172.16.0.0/12; it is a public address.
Question 5
When using Pretty Good Privacy (PGP) to digitally sign a message, the signature is created in a two-step process. First, the message to be signed is submitted to PGP's cryptographic hash algorithm.
What is one of the hash algorithms used by PGP for this process?
Show answer and explanation
Correct answer: C. SHA-l
SHA-1 (Secure Hash Algorithm 1) is one of the cryptographic hash algorithms used by PGP for creating digital signatures. PGP uses SHA-1 to hash the message before encrypting the hash with the sender's private key to create the digital signature.
Why the other options are wrong
- A. Blowfish is a symmetric encryption cipher, not a hash algorithm used by PGP for signatures.
- B. DES is a symmetric encryption algorithm, not a hash algorithm used in PGP's signature process.
- D. CAST is a symmetric encryption cipher, not a hash algorithm used by PGP for digital signatures.
Question 6
You are the security director for an off-shore banking site. From a business perspective, what is a major factor to consider before running your new vulnerability scanner against the company's business systems?
Show answer and explanation
Correct answer: A. It may harm otherwise healthy systems.
Running a vulnerability scanner against production banking systems carries significant risk of causing harm to otherwise healthy systems. Vulnerability scanners perform active probing and testing that can crash services, cause data corruption, or trigger resource exhaustion on sensitive production systems, making pre-scan impact assessment critical.
Why the other options are wrong
- B. False negatives are a technical limitation but not the primary business concern when deciding whether to run a scanner.
- C. False positives are a technical issue requiring validation but are less critical than the risk of system damage.
- D. While cost-benefit analysis is important, the immediate risk of harming production systems is a more critical business factor.
Question 7
Which of the following is a benefit to utilizing Cygwin for Windows?
Show answer and explanation
Correct answer: B. The ability to bring much more powerful scripting capabilities to Windows.
Cygwin provides Windows users with access to GNU/Linux utilities and tools, enabling much more powerful command-line scripting and Unix-like capabilities on Windows systems. This includes bash shells, sed, awk, grep, and other powerful text processing and scripting tools unavailable natively in Windows.
Why the other options are wrong
- A. Cygwin does not install a complete Red Hat operating system on Windows; it provides Unix-like tools and utilities within Windows.
- C. While Apache can technically run under Cygwin, it is not intended as a production server solution and Cygwin is not suitable for production deployments.
- D. Cygwin does not install a complete Ubuntu operating system on Windows; it provides a Unix-like environment and toolset.
Question 8
What technical control provides the most critical layer of defense if an intruder is able to bypass all physical security controls and obtain tapes containing critical data?
Show answer and explanation
Correct answer: C. Encryption
Encryption protects data confidentiality even after physical security fails. If an intruder obtains encrypted tapes, the data is unreadable without the keys. As a preventive technical control, it is the last line of defense, unlike controls that only record or react to an incident.
Why the other options are wrong
- A. Camera recordings document a breach but do not protect the tapes' data from access.
- B. Guards are a physical control, and the question assumes physical controls were bypassed.
- D. Shredding destroys media; it does not apply to tapes still holding critical data.
- E. Corrective controls act after the fact and cannot stop stolen tapes from being read.
Question 9
Two clients connecting from the same public IP address (for example – behind the same NAT firewall) can connect simultaneously to the same web server on the Internet, provided what condition is TRUE?
Show answer and explanation
Correct answer: C. The client-side source ports are different.
When two clients share the same public IP address behind a NAT firewall, the server distinguishes between them by their source ports. The NAT device translates each client's unique internal source port to different ports in outbound connections, allowing the server to maintain separate connections to both clients. This 5-tuple identification (source IP, source port, destination IP, destination port, protocol) is what enables simultaneous connections from the same public IP.
Why the other options are wrong
- A. The port number used by the server is irrelevant; simultaneous connections work on any server port with different client source ports.
- B. The network location of the server is irrelevant; the distinction happens at the NAT layer.
- D. Clients on different subnets still share the same public IP when behind the same NAT device, so this is not the determining factor.
Question 10
Which of the following is a standard Unix command that would most likely be used to copy raw file system data for later forensic analysis?
Show answer and explanation
Correct answer: A. dd
The `dd` command is the standard Unix utility for copying raw disk and file system data byte-by-byte, preserving all data including unallocated space, metadata, and deleted files. This makes it essential for forensic analysis where maintaining a bit-for-bit copy of the original media is critical. The `dd` command can create forensic images without interpreting the file system, which is exactly what forensic analysis requires.
Why the other options are wrong
- B. The `backup` command is not a standard Unix command for this purpose.
- C. The `cp` command copies files at the file system level, missing unallocated space and not suitable for forensic imaging.
- D. The `gzip` command is a compression utility, not designed for raw data acquisition or forensic imaging.
That was 10 of 279.
The full GIAC Security Essentials GSEC pack has all 279 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.