GSEC

Correct answer: C. C) Removing an asset from the environment · D. D) Altering business processes

Risk avoidance involves changing business processes or completely removing an asset to eliminate the associated threat. Outsourcing is a classic example of risk transfer, while ignoring a threat is simply negligence, not a valid strategy.

Correct answer: B. B) Craft a message so that every fourth word is the secret content. · D. D) Use whitespace encoding.

Using a concealment cipher or whitespace encoding allows hidden messages within text without requiring specialized graphical tools. Least significant bit manipulation applies to image or audio files, not standard ASCII text editing.

Correct answer: B. B) A keystroke logger wrapped inside of a browser plug-in

A keystroke logger wrapped inside a browser plug-in is a Trojan horse, not steganography, because it focuses on malware delivery rather than hiding secret messages. Steganography requires concealing information within a carrier file without revealing its presence.

Correct answer: D. D) Secure key exchange

Secure key exchange is the primary challenge of symmetric encryption because both parties need the same key over an insecure medium. Asymmetric cryptography solves this through digital envelopes and key agreement protocols.

Correct answer: A. A) Orthogonal frequency division multiplexing

Orthogonal frequency division multiplexing is a wireless modulation technique for encoding data onto multiple carrier frequencies, not a steganographic method. The other options represent legitimate ways to hide data within various media.

Correct answer: A. A) The private key is generated at random, and then the public key is derived from the private key.

In asymmetric cryptography, the private key is generated randomly, and the public key is derived from it using a one-way mathematical function. This prevents attackers from reverse-engineering the private key if they obtain the public key.

Correct answer: C. C) TLS

Transport Layer Security (TLS) is correct because it is the foundational protocol for VPN solutions like OpenVPN. For the exam, remember that while SSH supports tunneling, Secure Copy (SCP) is only a file transfer utility and not a VPN protocol.

Correct answer: A. A) Equip other organizations to handle a looming security concern.

Sharing threat intelligence equips other organizations to proactively handle looming security concerns. Sharing is about collective defense and awareness, not about removing intellectual property ownership or attempting to trick attackers into abandoning exploits.

Correct answer: A. A) Risk register

A risk register is used to formally list, categorize, and track all discovered risks within an enterprise risk management program. It serves as an actionable tracking document, whereas threat models are used to evaluate specific vulnerabilities.

Correct answer: A. A) Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, Elevation of privilege

STRIDE correctly stands for Spoofing identity, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Use this mnemonic on the exam to quickly distinguish it from other models like DREAD, which focuses on damage and exploitability.

Correct answer: D. D) Harming the threat agent

Risk deterrence involves discouraging attackers by threatening harm or retaliation, such as actively pursuing prosecution. For the exam, clearly distinguish this from risk mitigation, which focuses on implementing safeguards rather than threatening the threat agent.

Correct answer: A. A) Brute force

A brute force attack systematically attempts every possible key in the keyspace to find the exact symmetric key used for encryption. While dictionary attacks target passwords, brute force is the only method guaranteed to eventually find the specific key.

Correct answer: C. C) It uses changed and unchanged elements to encode the hidden message

LSB steganography is exceptionally difficult to detect because it uses a mixture of changed and unchanged elements to encode hidden messages. This lack of a consistent alteration pattern prevents easy detection, unlike file size or hash value changes.

Correct answer: D. D) Formal risk acceptance

Producing a document showing formal risk acceptance, signed by senior management, defends against accusations of ignoring a risk. Implementing countermeasures after the fact is too late, as proper risk management requires documentation before an incident occurs.

Correct answer: D. D) Reactive state

A reactive state describes an organization that only addresses security incidents after they happen. The proactive state is the opposite, meaning the organization plans ahead and implements controls before a compromise occurs.

Correct answer: B. B) The avalanche effect

The avalanche effect ensures that even a tiny change in the input data produces a significantly different hash output. While binary math is heavily used in cryptography, the avalanche effect specifically guarantees strict integrity violation detection.

Correct answer: A. A) Static symmetric keys

Secure virtual private networks rely on ephemeral session keys rather than static symmetric keys, which are heavily vulnerable to interception. Hashing, digital signatures, and asymmetric key pair sets are all required components to establish secure tunnels.

Correct answer: D. D) To discover flaws

Public algorithms allow the global cryptography community to thoroughly analyze and test the mathematical structure to discover any hidden flaws. Security relies entirely on the secrecy of the private key, not on keeping the algorithm itself hidden.

Correct answer: C. C) Steganography

Steganography hides secret messages within ordinary files and is not a core component of a public key infrastructure. Public key infrastructure strictly combines asymmetric encryption, symmetric encryption, hashing, and digital certificates.

Correct answer: B. B) pagefile.sys

A pagefile is a poor steganography host because the operating system constantly modifies it. Steganography requires a static host file to prevent hidden data from being overwritten or corrupted, making images or executables much safer choices.

Correct answer: D. D) SLE

Single loss expectancy, or SLE, represents the expected financial loss from a single security incident. Remember the exam formula SLE equals asset value multiplied by exposure factor, which contrasts with annualized loss expectancy calculations.

Correct answer: C. C) Assigning a risk to another entity

Risk transfer involves shifting the potential impact of a risk to a third party, typically through purchasing insurance. Do not confuse this with risk mitigation, which reduces the likelihood or severity of the threat using internal safeguards.

Correct answer: C. C) (ALE1 - ALE2) - CCM

The cost benefit equation is calculated by taking the annualized loss expectancy before a safeguard, subtracting the reduced annualized loss expectancy, and then subtracting the cost of the countermeasure. Remember that annualized loss expectancy alone only calculates total potential risk.

Correct answer: D. D) EXXEGO

A four position substitution cipher, commonly known as a Caesar shift, encrypts ATTACK into EXXEGO by shifting each letter forward four positions in the alphabet. Recognizing standard alphabetical shifts helps quickly eliminate transposition or reversal distractors.

Correct answer: B. B) It is derived from historical occurrences.

The annualized rate of occurrence is derived from historical occurrences to estimate how often a threat might materialize over a year. Remember that asset value determines exposure factor or loss, but frequency relies on past incident data.

Correct answer: B. B) Quantitative

Quantitative risk assessment relies on mathematical formulas like annualized loss expectancy to calculate risk. A strong exam cue is to look for dollar amounts, while qualitative methods use subjective rankings like high, medium, and low.

Correct answer: C. C) A request by the Office of the Secretary of Defense to the NSA to assist with prioritizing security controls based on defending against known attacks

The controls originated from a request by the Office of the Secretary of Defense to the National Security Agency to prioritize defenses against known attacks. Remember that these controls focus on mitigating actual, documented real-world threats.

Correct answer: A. A) It focuses on using mostly pre-screened systems.

The Facilitated Risk Assessment Process saves time and money by focusing strictly on pre-screened systems and evaluating risk through a business impact assessment. OCTAVE is the methodology known for using three distinct phases of workshops.

Correct answer: B. B) It helps with internal transparency, risk assessment, risk response, and risk monitoring.

Reporting risks as defined by enterprise risk management directly enables internal transparency, assessment, response, and monitoring. While strategic planning and compliance are essential security concepts, they are not the primary purpose of the risk reporting phase.

Correct answer: D. D) Confidentiality, integrity, authentication, and non-repudiation

Cryptographic solutions provide confidentiality, integrity, authentication, and non-repudiation. Be careful not to confuse these services with the CIA triad, as cryptography does not directly provide availability, or with access control concepts like AAA.

Correct answer: C. C) Decryption

Decryption is the process of converting ciphertext back into readable plaintext. For a quick cue, remember that encryption turns plaintext into ciphertext, while decryption reverses the process using the proper cryptographic key.

Correct answer: A. A) User impersonation

User impersonation is often the most successful way to compromise encryption because it bypasses strong algorithms by stealing access to the keys. Brute forcing modern cryptography takes millennia, making direct attacks highly impractical.

Correct answer: C. C) The steganography encoding technique is unknown.

The stego-only attack rarely reveals hidden data because the analyst lacks knowledge of the specific encoding technique used. Without the right tool or understanding how the payload was concealed, extracting the hidden message from the carrier file is nearly impossible.

Correct answer: D. D) Safeguard selection

Selecting security mechanisms and mitigation options occurs during the safeguard selection phase of risk management. This step happens before cost benefit analysis, where you determine if deploying the chosen countermeasure makes financial sense.

Correct answer: A. A) To prove that a message did not change in transit · E. E) To indicate the communication's sender

Digital signatures use the sender's private key to encrypt a message hash, verifying integrity and authenticating the sender's identity. Be careful not to confuse signatures with encryption; signatures do not provide confidentiality or restrict who can read the message.

Correct answer: B. B) Chosen-message

The chosen-message technique uses an intercepted communication and a known host file with a known tool to re-create steganography outputs. Contrast this with known-cover, which simply compares an original cover file directly against an already embedded version.

Correct answer: A. A) They are a third-party proof with public key cryptography.

Digital certificates are reliable because a trusted third party, known as a certificate authority, validates the subject's identity using public key cryptography. Distractors mentioning biometrics, cloud storage, or memorized information describe different authentication factors or delivery mechanisms, not the core mechanism.

Correct answer: C. C) EFS

The Encrypting File System, or EFS, provides data at rest encryption for files stored on disk. The other choices are protocols designed to encrypt data in transit across a network, protecting communications rather than stored files.

Correct answer: C. C) Asset value * percentage of potential loss * annualized rate of occurrence

The correct formula multiplies asset value by the exposure factor and the annualized rate of occurrence to calculate annualized loss expectancy. The other primary formula shown is used for cost-benefit analysis rather than determining the inherent risk level.

Correct answer: D. D) Trust in the third party is not established.

Accepting an unknown certificate authority establishes trust in an unverified third party, breaking the chain of trust. You should only trust root certificates pre-installed by the operating system or explicitly approved by administrators.

Correct answer: C. C) Using a digital signature

Applying a digital signature uses the sender's private key, which automatically includes their public certificate. This allows the recipient to verify identity and validate the signature.

Correct answer: C. C) Link-based security tunneling

A host-to-site virtual private network provides link-based security tunneling that encapsulates all traffic, not just web communications. However, this is technically ambiguous because modern TLS VPNs also provide host-to-site access using application-layer encryption.

Correct answer: D. D) Check hash, discover CA, check TRL, check validity dates, check for revocation, and make trust choice

The certificate validation process begins by checking the hash to ensure file integrity, then discovering the issuing certificate authority, and ending with a final trust choice. Always verify that the digital fingerprint remains completely unaltered first.

Correct answer: C. C) To provide data confidentiality

The primary purpose of cryptography is to provide data confidentiality through encryption. While hashing provides integrity and digital signatures offer authentication, confidentiality remains the foundational reason for deploying cryptographic solutions.

Correct answer: C. C) Modulo

Modulo arithmetic calculates the remainder of a division operation, serving as a one-way function that improves substitution cipher security. For the exam, remember that modulo mathematics is also the foundational concept used to secure the Diffie Hellman key exchange process.

Correct answer: A. A) Computer evidence is classified as hearsay evidence.

Computer evidence is legally classified as hearsay, requiring strict collection procedures to qualify for the business records exemption. Proper chain of custody and hashing are required to prove that digital evidence remains unaltered.

Correct answer: B. B) One-time password

A hardware token with a display screen generates dynamic one-time passwords for authentication. This time-based password changes frequently, preventing replay attacks even if an attacker intercepts the credentials.

Correct answer: B. B) Monitor which users perform system management or account management operations.

Monitoring which users perform system or account management operations directly evaluates the control of administrative privileges. Watching for unauthorized privileged actions ensures that elevated access is strictly limited and properly tracked.