GSEC

Correct answer: D. D) True positive

A true positive occurs when a malicious attack triggers a detection system alarm. It is crucial to distinguish this correct alert from a false positive, where normal behavior is mistakenly flagged, or a false negative, where an actual attack is missed entirely.

Correct answer: C. C) An ICMP Type 3 Code 3

A closed UDP port without a firewall responds with an ICMP Type 3 Code 3 destination unreachable message. Remember that UDP lacks built-in session management, so systems rely on ICMP to signal that the target port is closed.

Correct answer: D. D) It poisons Web content.

Cross-site scripting attacks work by injecting malicious scripts into trusted web content, effectively poisoning the website. The strongest distractors describe delivery methods or unrelated attacks, whereas the core risk of this vulnerability is content manipulation.

Correct answer: B. B) Implementing centralized analysis with numerous remote sensor agents

Large environments achieve network-wide visibility by deploying remote sensor agents that feed data to a centralized analysis engine. While connecting to a SPAN port is necessary for traffic capture, relying on isolated sensors prevents seeing the overall security picture.

Correct answer: A. A) The potential operating system and types of services running on the target

Open TCP and UDP ports reveal the potential operating system and the types of services running on a target machine. Security professionals use these port numbers to infer system characteristics, as specific services typically listen on well-known standard ports.

Correct answer: D. D) It demonstrates an attacker's ability to mask their activities.

The final clearing tracks phase demonstrates an attacker's ability to mask their activities by altering or deleting logs. This step proves that standard logging is vulnerable to tampering, highlighting the need for protected centralized logging solutions.

Correct answer: B. B) Initialization vector

An initialization vector is a cryptographic component used in encryption algorithms, not a detection mechanism used by intrusion detection or prevention systems. For the exam, associate detection methods with anomaly, behavioral, and heuristic analysis, leaving cryptographic terms separate.

Correct answer: A. A) CSRF

Cross-site request forgery works by hijacking a victim's authenticated session to submit unauthorized commands to a web server. Other options like SQL injection exploit database queries, whereas this attack specifically leverages the established trust of an active encrypted connection.

Correct answer: C. C) Discovered weaknesses are secured by the IT staff.

Vulnerability scans improve security only when IT staff actively remediate the discovered weaknesses. Simply generating reports or performing routine scans provides no actual protection unless those identified flaws are properly mitigated and resolved.

Correct answer: C. C) Information gathering and reconnaissance

Information gathering and reconnaissance heavily rely on open-source intelligence, meaning attackers interact mostly with public resources rather than the target's monitored network. Active phases like scanning and exploitation trigger alerts, whereas passive research avoids direct detection.

Correct answer: D. D) White box

A white box test provides ethical hackers with full knowledge and documentation of the target environment prior to the assessment. Black box testing offers zero prior knowledge, while grey box testing only discloses partial documentation to the evaluation team.

Correct answer: D. D) A recent security breach

Having a recent security breach is never a prerequisite for conducting a penetration test. Examiners expect you to know that organizations must possess mature security foundations, such as written policies and reliable backups, before authorized testing begins.

Correct answer: D. D) Impersonation

A stolen cookie allows an attacker to impersonate the victim by reusing the active session token. Session hijacking enables immediate account access, unlike SQL injection or denial of service attacks.

Correct answer: D. D) Notify the administrator.

Notifying the administrator is passive because it does not interfere with the attacker or alter the system state. Active responses actively disrupt the attack, such as terminating processes or disconnecting sessions.

Correct answer: A. A) to defend against SQL injection

Escaping meta-characters neutralizes malicious injected commands, providing a primary defense against SQL injection attacks. Buffer overflows require bounded inputs for mitigation, making length filtering rather than character escaping the relevant control mechanism.

Correct answer: C. C) TLS

Transport Layer Security is the primary protocol used to encrypt and secure web communications across the internet. Secure Shell manages remote administration, while IPsec secures virtual private network tunnels rather than individual web browsing sessions.

Correct answer: B. B) Short and simple passwords

Vulnerability scanners generally cannot detect short and simple passwords because they do not perform brute-force authentication attacks. A separate password cracking tool is required to identify weak credentials, whereas scanners easily find missing updates.

Correct answer: D. D) Use of a honeypot can distract hackers from breaching live systems

A primary advantage of a honeypot is distracting attackers by drawing them toward a decoy system and away from live production servers. The other options represent significant deployment disadvantages, such as increased risk if a honeypot is fingerprinted.

Correct answer: C. C) If the client software is configured to craft IP packets using a specific destination address

A non-transparent proxy requires the client software to be explicitly configured with the proxy server's address as the destination. A transparent proxy intercepts traffic automatically without client configuration, whereas user notification and NAT presence are irrelevant.

Correct answer: D. D) to trick victims into providing sensitive data

Attackers plant unvalidated redirects or forwards on a website to trick victims into visiting malicious sites and providing sensitive data. This stealthy redirection is often used for phishing rather than causing buffer overflows or cloning websites for offline viewing.

Correct answer: A. A) At the primary ISP demarcation point

The primary appliance firewall provides the most benefit when positioned at the network edge, specifically the ISP demarcation point. This perimeter placement filters traffic before it enters the internal network, whereas internal devices rely on software firewalls.

Correct answer: A. A) Behavioral, anomaly, and heuristic detection

Behavioral, anomaly, and heuristic detection mechanisms allow an intrusion detection system to identify new and unknown attacks. Instead of relying on known signatures, these methods evaluate deviations from a baseline to flag suspicious activity, though false positives may occur.

Correct answer: B. B) The source IP address and destination port number

A packet-filtering firewall operates at OSI layers three and four, making decisions based on the source IP address and destination port number. It does not inspect deep packet content or MAC addresses, which are features of higher or lower layer controls.

Correct answer: B. B) IP address detection

An IP address alone merely confirms a device is active on the network, revealing nothing about its operating system or role. Port scanning, banner grabbing, and service enumeration actively probe the host to fingerprint its specific software and configuration.

Correct answer: C. C) With mutual certificate authentication via TLS

Mutual certificate authentication via TLS stops man-in-the-middle attacks by requiring both the client and server to cryptographically prove their identities. Standard TLS without mutual authentication still leaves sessions vulnerable to clever interception and credential theft.

Correct answer: B. B) The site allows hidden form fields.

Relying on hidden HTML form fields for pricing allows attackers to easily modify the price value locally before submitting the form. Servers must always retrieve prices from a secure backend database rather than trusting user-controllable client inputs.

Correct answer: B. B) Stateful inspection firewall

Stateful inspection firewalls maintain context about active network connections, allowing them to easily recognize the rapid sequential probing typical of port scans. Static packet filters lack this contextual memory and cannot effectively correlate the individual probes.

Correct answer: C. C) Heartbleed Bug

The Heartbleed bug was a severe OpenSSL flaw allowing attackers to read protected system memory and steal encryption keys or plaintext data. Zeus and CryptoWall are malware families, while VENOM targeted virtual machine hypervisors.

Correct answer: B. B) A SYN scan duplicates the connection request from a legitimate client.

A TCP SYN scan mimics the initial step of a legitimate connection request, making it stealthier than completing a full handshake. Because it closely resembles normal traffic, simple packet-filtering firewalls often fail to block it, allowing the scanner to detect open ports.

Correct answer: D. D) Testing new code on a live Internet site

Testing new code on a live internet site introduces unnecessary risk, as unvetted changes can expose critical flaws to attackers. For the exam, remember that proper secure development lifecycle practices mandate strict separation of development, testing, and production environments.

Correct answer: A. A) One can stop an attack from becoming successful.

An intrusion prevention system can actively stop an attack from becoming successful, whereas an intrusion detection system generally only alerts on the activity. Remember that prevention systems sit inline to block traffic, while detection systems merely monitor.

Correct answer: A. A) Network topology

A host-based intrusion detection system monitors internal system activities like drive writes and active processes, not network topology. Network topology is strictly a concern for network-based intrusion detection systems, which require strategic sensor placement.

Correct answer: B. B) Host-based systems are dependent upon the stability of the OS.

Host-based security tools depend heavily on the stability of the underlying operating system, meaning an unstable or compromised system might disable the protection. Unlike network sensors, host agents operate as software processes and consume local resources.

Correct answer: B. B) Information gathering and reconnaissance

Information gathering and reconnaissance consumes the most time because testers must thoroughly research leaked data about the target. Remember that while exploitation gets the glory, discovery is the longest phase.

Correct answer: A. A) A honeynet includes multiple systems, while a honeypot includes only a single system.

A honeynet is simply a network constructed of multiple honeypot systems, whereas a honeypot is typically a single decoy system. Do not overthink logging capabilities; focus on the architectural scale difference.

Correct answer: B. B) The honeypot is a false entity.

Honeypots are false entities, which makes prosecution tricky because courts might view them as entrapment or question the damages. Since the system is fake, proving actual harm is difficult.

Correct answer: C. C) Gaining access

Privilege escalation, converting standard access into higher privileges, occurs during the gaining access phase of a penetration test. Testers exploit vulnerabilities here to elevate their permissions after initial compromise.

Correct answer: D. D) Details about a new unknown exploit

Honeypots are valuable for discovering details about new, previously unknown exploits or zero-day attacks. Since any traffic interacting with a honeypot is suspicious by default, analysts can safely analyze novel attack methods.

Correct answer: C. C) Retaliation

Exposed honeypots often trigger retaliation because attackers actively target organizations that attempt to deceive them. Avoidance is unlikely since hackers rarely ignore a discovered system, whereas port scanning is just a precursor to larger retaliatory attacks.

Correct answer: A. A) Encrypting connections with TLS

Transport Layer Security only protects data in transit from eavesdropping and fails to validate server-side payload contents. Filtering input length, blocking known patterns, and escaping meta-characters actively inspect and sanitize data to prevent injection exploits.

Correct answer: A. A) In front of a public Web server

Deploying a honeypot near a public web server ruins the deception because attackers will target the legitimate resource instead. Honeypots are best placed in isolated server farms or near restricted internal access points like VPN concentrators.

Correct answer: B. B) False positives on the report

False positives represent the biggest risk because they waste valuable administrator time and resources during manual verification. A vulnerability scanner is a passive tool, so it discovers configurations and missing patches without actively exploiting or damaging targets.

Correct answer: A. A) Malicious code

Active content risks executing malicious code on a victim system because browsers run downloaded scripts with user privileges. While phishing and social engineering target human behavior, active content directly compromises the local machine through code execution.

Correct answer: C. C) Use an unauthorized direct connection to the victim.

An attacker bypasses perimeter security by establishing an unauthorized direct connection to the victim. Application-layer firewalls inspect traffic deeply, so merely encapsulating payloads or encrypting the attack will still trigger alerts across monitored network paths.

Correct answer: C. C) It discards all unnecessary traffic.

The primary benefit of a firewall is discarding unrecognized traffic by enforcing an implicit deny stance. While modern unified threat management appliances might handle caching or malware scanning, traditional firewalls focus strictly on traffic filtering and load balancing.

Correct answer: A. A) By marking unauthorized communications

A honey token helps investigators track unauthorized activity by marking illegitimate communications with unique identifiers like fake credentials. If an attacker uses these trapped values elsewhere, the resulting alerts pinpoint the compromise without blocking access.

Correct answer: B. B) to discover the status of port numbers and IP addresses

Penetration testers use network discovery tools like nmap and hping to identify active IP addresses and determine the status of port numbers. This scanning phase maps the attack surface, unlike gathering access or initial reconnaissance which relies on public sources.

Correct answer: D. D) Source socket

The source socket identifies the origin of network traffic in a Snort rule, making it essential for detecting unwanted communication from known malicious IP addresses. The rule action then dictates whether to alert or drop that specific matching traffic.

Correct answer: A. A) Detect an attack before it is successful.

Predicting and preventing an attack before it executes is inherently difficult because prevention systems must make rapid decisions with minimal initial data. Notifying administrators or dropping suspicious sessions after detection are far simpler reactive tasks.

Correct answer: B. B) Outside the appliance firewall

Placing sensors outside the primary firewall exposes them to massive volumes of meaningless internet background radiation, causing extreme false positives. You want sensors positioned behind the firewall to inspect filtered traffic heading toward actual internal targets.

Correct answer: C. C) It is unable to detect unknown attacks

Intrusion prevention systems struggle to reliably detect zero-day or unknown attacks because they primarily rely on known signatures and historical patterns. Blocking known malware signatures or abusive IPs is already highly effective and fully realized.

Correct answer: A. A) because of the potential presence of firewalls

Stateful firewalls detect port scans by tracking multiple rapid connection attempts from a single source over a short time window. Spacing out probes prevents triggering this threshold, ensuring the firewall drops your scanning traffic and blocks accurate results.

Correct answer: A. A) Encrypt the connection.

Encrypting the connection blinds a network intrusion detection system because the sensor cannot decrypt the payload to inspect it for malicious signatures. If the NIDS lacks access to the session keys, it cannot evaluate the encrypted traffic contents.

Correct answer: C. C) To confirm discovery of actual systems

Crafting a network visibility map confirms the discovery of actual systems deployed in the infrastructure, ensuring the assessment covers everything. This mapping process verifies that active scanning successfully found legitimate devices and missed nothing important.

Correct answer: D. D) One relies upon manual attacks performed by skilled professionals

Penetration testing relies on manual attacks performed by skilled professionals to actively exploit vulnerabilities, whereas vulnerability scanning uses automated tools to identify weaknesses. Examiners emphasize that scanning finds flaws, while penetration testing actively exploits them.

Correct answer: C. C) To minimize the risk of active content

Managing mobile code per domain minimizes the risk of malicious active content, like JavaScript, executing unchecked in the browser. Plugins restrict scripts to trusted sites, preventing automatic execution everywhere.

Correct answer: D. D) Backdoors

Borrowed scripts from free repositories often contain hidden backdoors providing unauthorized system access. Always review third-party code thoroughly before deployment to prevent hidden administrative logins.

Correct answer: B. B) Inbound ports are always open.

Static packet filters require inbound ports to remain open so clients can receive requested traffic. This exposes clients to arbitrary inbound connections, whereas stateful firewalls dynamically open ports only for valid sessions.

Correct answer: A. A) The weaknesses of your environment are not discoverable with this tool.

A clean report only means the scanner did not find flaws within its specific detection database. Remember that no scanner is omnipotent; many vulnerabilities require manual discovery or are simply unknown to the tool.

Correct answer: A. A) Do not steal funds out of company bank accounts.

Consultants are strictly constrained by law and ethics, meaning they cannot commit actual crimes like stealing funds from company bank accounts. While clients might initially prohibit social engineering or denial of service attacks, testers can negotiate those rules.