GSEC

Correct answer: B. B) A flood in the basement server room

A disaster recovery plan is triggered when mission-critical business functions are interrupted. A data breach is an incident, while flooding a server room threatens operations and invokes recovery procedures.

Correct answer: C. C) Installing and updating anti-virus software

Installing and updating anti-virus software is a preventative cost associated with malware management. Post-infection damages like network downtime and lost productivity are reactive costs, not preventative measures.

Correct answer: A. A) Employee comments

Employee comments are not a formal component of a security policy framework. Policies, standards, guidelines, and procedures are the core documents used to define and enforce an organization's security posture.

Correct answer: B. B) To prevent the spread of a violating event to other systems

The lessons learned phase focuses on documentation to improve future responses, train new team members, and support legal defense. Preventing an incident from spreading is the goal of the containment phase.

Correct answer: D. D) AAA verifies unique identities and then holds them accountable for their actions.

AAA frameworks are essential because they verify unique identities and hold users accountable for their actions. It does not inherently encrypt communications, which requires separate protocols like TLS.

Correct answer: C. C) Ports are kept open for nonessential services.

A vulnerability is a weakness that an attacker may discover and exploit. Open ports for nonessential services expand the attack surface, whereas malware and botnets represent threats or actors causing harm.

Correct answer: D. D) Control access to resources

Authorization controls access to resources based on the privileges granted to a verified user. Exam candidates must carefully distinguish this from authentication, which merely verifies identity, or accounting.

Correct answer: D. D) Eavesdropping on beacon frames

Eavesdropping on beacon frames allows devices to detect wireless networks broadcasting in the area. Ping sweeps and port scans require an existing network connection and cannot discover disconnected networks.

Correct answer: B. B) Strongly encourage workers to always follow company policy, regardless of what someone over the phone or via email demands.

Strongly encouraging workers to follow company policy reduces social engineering risks by preventing attackers from bypassing rules. Technical controls like encryption do little to stop an attacker manipulating human trust.

Correct answer: B. B) Training and awareness

Security vulnerabilities in personnel are most effectively addressed through ongoing security training and awareness programs. Technical controls like firewalls and encryption do not mitigate human weaknesses, so remember that human manipulation requires human-focused defenses.

Correct answer: B. B) It sets boundaries for allowed activities.

Authorization is important because it sets the specific boundaries for what activities an authenticated user is allowed to perform. Do not confuse this with authentication, which merely verifies identity, or auditing, which monitors actions after the fact.

Correct answer: C. C) DAC is decentralized.

Discretionary access control is decentralized because data owners manage permissions directly through access control lists on their objects. A strong exam cue is that mandatory access control is centralized and rigid, whereas discretionary access control distributes control.

Correct answer: B. B) It mimics the identity of a trusted WAP.

An evil twin attack is effective because it mimics the identity of a trusted wireless access point to trick devices into connecting. Clients automatically favor the strongest signal matching a saved profile, allowing the attacker to intercept traffic easily.

Correct answer: B. B) An untrained employee

An untrained employee should never collect evidence because they are likely to damage its integrity or break the chain of custody. Proper evidence handling requires forensically trained personnel to ensure the data remains admissible in legal proceedings.

Correct answer: B. B) nmap

Nmap is the standard network mapping tool used for port scanning, OS fingerprinting, and banner grabbing. Aircrack targets wireless encryption, while Cain and Abel focuses on password cracking.

Correct answer: B. B) Disconnecting systems from the Internet

Disconnecting systems typically happens during containment to isolate threats. The recovery phase focuses on restoring normal operations by applying patches, updating firmware, and validating authentication configurations.

Correct answer: C. C) Define the organization's security intentions and approach

A security policy defines an organization's security intentions and establishes its overall approach to protection. Punishing rule violators or preventing wasted resources might be beneficial outcomes, but they are not the primary purpose of the document.

Correct answer: D. D) SYN flood

A hexadecimal value of 0x02 translates to binary 00000010, indicating the TCP SYN flag is set, which represents a SYN flood. For the exam, remember how to map protocol header flags to hexadecimal values to identify network attacks quickly.

Correct answer: C. C) NTP synchronization logs

NTP synchronization logs are the least helpful because they primarily record time adjustments and rarely reveal direct attack evidence. In contrast, server, DHCP, and IDS logs provide critical context linking malicious activities to specific IP addresses and systems.

Correct answer: C. C) Symmetric encryption

Symmetric encryption provides confidentiality by ensuring only authorized parties with the correct key can access the data. Hashing provides integrity, while redundant servers and periodic backups primarily protect system and data availability.

Correct answer: A. A) Compare before and after hash values.

You verify file integrity by comparing hash values generated before and after an event. Hashing detects unauthorized modifications, whereas backups restore damaged files and digital envelopes focus on securing data confidentiality.

Correct answer: D. D) Corrupt an adversary's ability to act in their own interest

The primary offensive goal of information warfare is to corrupt an adversary's ability to make effective decisions and act in their own interest. A practical exam cue is to focus on the broad objective of decision disruption, whereas reconnaissance is merely a preparatory step.

Correct answer: C. C) Identify the violating activity

An incident response team can only handle an incident after the violating activity has been identified. Detection and identification are absolute prerequisites, whereas patching systems or notifying customers are subsequent actions taken during later recovery phases.

Correct answer: C. C) Taking advantage of social engineering

Malware increasingly bypasses technical security improvements by taking advantage of social engineering tactics. Attackers exploit human trust and curiosity because people are often the weakest link, making user training a critical defensive control.

Correct answer: C. C) When company policy is violated and business tasks are affected

Internal incident response is triggered when policy violations impact business tasks. Automated defenses handle routine scanning or guessing attacks, and law enforcement handles criminal events.

Correct answer: A. A) Denial of service

Denial of service directly violates availability by preventing legitimate access to resources. Disclosure and leakage violate confidentiality, while corruption violates data integrity.

Correct answer: D. D) User identity

Discretionary access control bases permissions directly on user identity or group membership. Object classification is used for mandatory access control, while job roles define role-based access control.

Correct answer: A. A) A security policy should be defined once and then enforced for at least a decade.

Security policies must remain flexible and be updated regularly as threats change, so decade-long enforcement is false. Policies require management support and universal compliance to maintain security effectively.

Correct answer: D. D) Software that causes unwanted harm, often automatically, once it infects a system

Malicious code is software that causes unwanted harm automatically once it infects a system. Remote control tools and password crackers are often classified as potentially unwanted programs rather than malware.

Correct answer: C. C) Minimize the number of open ports.

Minimizing open ports effectively defends against port scanning by reducing the attack surface. Host intrusion detection systems only alert on scanning activity, and multi-factor authentication prevents unauthorized access.

Correct answer: D. D) MAC

Mandatory access control is required because it enforces clearance labels and need-to-know compartmentalization typically seen in military environments. Discretionary access control is ruled out because it relies on data owners rather than strict system rules.

Correct answer: A. A) Offsite storage of backups

Offsite storage of backups is the most critical element because data cannot be recovered if all local copies are destroyed. Warm sites and clusters are useful for availability, but they are useless for data restoration without actual backups.

Correct answer: A. A) By performing a business impact analysis

A business impact analysis evaluates the consequences of disruptions to mission-critical processes during planning. Vulnerability scans and penetration tests are technical assessments, whereas continuity planning focuses on business risk and operational survival.

Correct answer: A. A) They grant ongoing undiscovered continued remote access to an IT infrastructure.

Advanced persistent threats grant attackers ongoing undiscovered remote access, allowing them to quietly mine data over long periods. Despite the name, they do not always cause immediate downtime and are not necessarily the most sophisticated attacks.

Correct answer: B. B) Immediately upon discovery

Law enforcement must be contacted immediately upon discovering a likely crime to ensure proper forensic collection of court-admissible evidence. Waiting until after containment or eradication risks contaminating the scene and destroying evidence.

Correct answer: B. B) To maintain availability

A business continuity plan is essential because it maintains the availability of mission-critical processes during a disruptive event. It focuses on keeping the business running rather than directly protecting confidentiality or reducing operational costs.

Correct answer: A. A) Reconnaissance

Reconnaissance is always the first step of an attack, allowing adversaries to gather preliminary information about the target. Enumeration happens later alongside scanning, while clearing tracks and pilfering data occur after a breach is successful.

Correct answer: B. B) Authentication

Authentication proves identity, and multi-factor authentication makes impersonation much harder. Accounting tracks and logs actions, but strong authentication is the specific mechanism that requires multiple elements and reliably ensures the correct individual is held accountable.

Correct answer: A. A) Business impact analysis

A business impact analysis evaluates risks by focusing on how threats affect critical business tasks rather than individual assets. Threat modeling is closely related, but business impact analysis specifically guides business continuity and disaster recovery planning.

Correct answer: A. A) Radio waves can still be detected. · D. D) Other management frames contain the SSID.

Disabling the SSID broadcast fails because radio waves remain physically detectable and probe responses leak the SSID. Hiding the network name only inconveniences users, as attackers can easily extract it from other wireless management frames.

Correct answer: C. C) Expanded preparedness, including attack analysis, vulnerability research, and response drills

Expanded preparedness through training, vulnerability research, and drills directly improves incident response before an event happens. Post-mortem reviews are valuable, but they occur after an incident, making preparation the correct proactive step.

Correct answer: A. A) They may satisfy due care and due diligence.

Security policies demonstrate that an organization meets legal standards for due care and due diligence. They do not guarantee breach prevention, and simply spending money or logging events does not legally prove proper security practices were followed.

Correct answer: D. D) Educate users.

An incident response team focuses on preventing, detecting, and responding to violations, not educating users. Security awareness training is a critical security management responsibility, but it falls outside the core incident handling lifecycle.

Correct answer: C. C) shadow

Linux and Unix systems store password hashes in the restricted shadow file to protect them from unauthorized access. The passwd file is readable by all users, so it only stores basic account details while omitting the actual hashes.

Correct answer: C. C) Alter user behaviors.

Altering risky user behaviors is the most effective way to reduce malware infections, especially against zero-day threats. Technical controls like encryption or authentication cannot stop malware if a user is tricked into executing it.

Correct answer: D. D) A job label is placed on the user account.

Role-based access control assigns access privileges by placing a job or role label on a user account. This differs from discretionary control, which uses object-level lists, and mandatory control, which assigns security classifications.

Correct answer: A. A) Kerberos

Kerberos is a widely used single sign-on technology that allows users to authenticate once and access multiple services. Certificates and biometrics are individual authentication factors, while access control lists handle authorization.

Correct answer: C. C) Enable WPA-2.

Enabling strong encryption like WPA2 or WPA3 provides the best defense against wireless intrusions. Other measures like MAC filtering or disabling SSID broadcasts offer minimal protection against determined attackers.

Correct answer: B. B) Lessons learned · C. C) Eradication

The original answer keys eradication for removing offending elements like malicious accounts. However, disabling an active account to stop an attack in progress is a textbook containment action. The ambiguous wording makes containment an equally defensible correct answer on the exam.

Correct answer: B. B) Through user activities

Viruses generally propagate through user activities, requiring a host file to be executed. Worms distinguish themselves by self-replicating across networks, and Trojans trick users with benign facades.

Correct answer: B. B) Flattening an organization's hierarchical authority structure

Flattening hierarchical authority is considered the most critical but impractical defense against information warfare because rigid structures collapse if leadership is targeted. For the exam, associate distributed backups and encryption with standard best practices rather than difficult organizational shifts.

Correct answer: C. C) It reduces the potential for impersonation.

Multifactor authentication reduces impersonation risk by forcing attackers to compromise multiple independent authentication factors. It does not inherently prevent data loss or verify accuracy, as those are handled by access controls and hashing.

Correct answer: A. A) Submitting scripted input using meta-characters

Submitting scripted input using meta-characters can alter server-side execution, leading to arbitrary code execution in injection attacks. Pharming and hidden form field manipulation redirect users or alter client-side data without executing code.

Correct answer: A. A) Asymmetric investment vs result

Information warfare is concerning because attackers can cause massive damage with very little investment. Standardized languages and operating systems might make targets easier to understand, but the primary concern remains the highly asymmetric ratio between cost and result.

Correct answer: D. D) Predictable TCP sequence values

The Mitnick-Shimomura attack exploited predictable TCP sequence numbers to hijack a trusted session. Memorizing historical attacks is crucial for the exam, even though modern operating systems now generate sequence numbers randomly to prevent spoofing.

Correct answer: A. A) Follow standard forensic procedures.

Following standard forensic procedures ensures evidence integrity and admissibility in court. Merely copying logs without hashing or improperly imaging drives breaks the chain of custody, making the evidence unusable during legal proceedings.

Correct answer: F. F) Sophistication level: Advanced · G. G) Maturity: Simple, easily accessed tools and not necessarily targeted · H. H) Maturity: Technically mature and developed by advanced hackers

DDoS attacks represent an advanced sophistication level within information warfare, utilizing technically mature tools developed by experienced hackers. Basic levels involve script kiddies, while top levels are advanced persistent threats.