GSEC

Correct answer: C. C) Something that can cause harm to an asset

The correct answer works because a threat is defined as any potential danger that can cause harm to an asset. For the exam, remember that a vulnerability is a weakness, while risk is the likelihood that a threat will exploit that weakness.

Correct answer: D. D) Social engineering

The correct answer works because social engineering targets human vulnerabilities to gain access to systems, information, or physical spaces. Technical attacks like buffer overflows or SQL injection focus on software flaws and rarely grant physical entry.

Correct answer: B. B) Scanning devices can be fooled.

The correct answer works because biometric scanning devices can often be fooled by false versions of a body part. Therefore, relying on biometrics as the sole authentication factor is risky without combining it with additional factors like passwords or tokens.

Correct answer: A. A) Implement defense in-depth.

The correct answer works because implementing defense in depth uses multiple overlapping security controls to protect assets. If one mechanism fails or is compromised, the remaining layers continue to provide protection against the attacker.

Correct answer: A. A) Authorization and defining security protection needs

The correct answer works because defining data classification establishes who is authorized to access information and determines its specific security protection needs. Classification is fundamentally an authorization mechanism, not an authentication or auditing tool.

Correct answer: A. A) Reporting suspicious activity

The correct answer works because reporting suspicious activity is a universal responsibility assigned to all workers within an organization. Technical tasks like backing up servers or configuring encryption are delegated to specific administrative roles.

Correct answer: D. D) pass

The correct answer works because the pass action in a Snort rule explicitly tells the intrusion detection system to ignore matching packets. This prevents unwanted alerts when analyzing benign traffic that might otherwise trigger a rule.

Correct answer: A. A) chmod

The correct answer works because the chmod command is used to modify file mode bits, which control read, write, and execute permissions. Other commands like chown and chgrp only change file ownership or group association.

Correct answer: D. D) It includes recommended best practices for setting up and securing a Linux system.

The correct answer works because CIS Benchmarks provide established configuration baselines and recommended best practices for securely setting up systems. They focus on hardening operating systems against known vulnerabilities rather than improving performance.

Correct answer: C. C) root

The root account is the most powerful default account in Linux, holding complete administrative control over the entire system. A quick exam tip is to associate root with Linux, while the administrator account belongs to Windows environments.

Correct answer: D. D) View the contents of the /var/log/secure file.

Viewing the /var/log/secure file reveals authentication events, including failed logon attempts that indicate credential attacks. For the exam, remember that secure or auth logs are the primary sources for verifying login failures, whereas cron logs track scheduled tasks.

Correct answer: D. D) VFS

The virtual file system, or VFS, enables Linux to support a wide range of file system formats by providing a standard interface. Avoid confusing this with SMB, which is used for sharing network resources rather than managing local storage compatibility.

Correct answer: B. B) To be guided through a systematic security evaluation and hardening process

Bastille Linux guides administrators through a systematic security evaluation and hardening process rather than automatically applying settings. Do not confuse this with robust firewalls or web servers, as Bastille focuses primarily on interactive system configuration improvements.

Correct answer: C. C) To add modern, complex, multi-factor authentication options to Linux

Pluggable authentication modules, or PAM, add modern authentication options like multi-factor support to Linux. PAM does not modify password hashes or relocate them to the shadow file, it integrates advanced authentication mechanisms into the system.

Correct answer: B. B) Use the mount command.

The mount command connects a newly attached storage device to the file system, making it accessible to users. Remember that newly attached devices appear in the dev folder but remain inaccessible until properly mounted.

Correct answer: D. D) Modify the configuration files.

Modifying configuration files is the standard method to alter the operation of programs and services in Linux. Unlike Windows, Linux does not use a centralized registry, relying instead on individual text files for customization.

Correct answer: C. C) passwd

The passwd command allows administrators to set or change user passwords in Linux. Avoid confusing this with the Windows command net user or group management tools, as passwd is the native Linux utility for account credentials.

Correct answer: C. C) xkill

The xkill command allows users to terminate unresponsive graphical programs by changing the cursor into a crosshair to click and close the targeted window. Process viewers like top only display information and do not directly terminate applications.

Correct answer: C. C) Promptly test patches before installing approved updates onto systems.

The most reliable patch management approach is to test updates promptly before deployment to prevent unexpected downtime. Installing patches blindly risks system instability, while waiting for an actual breach causes unnecessary exposure.

Correct answer: B. B) Creating regular backups

Creating regular backups is a security best practice and does not cause system compromise. Actual causes of compromise include unpatched vulnerabilities, leftover default accounts, and installing software from untrusted repositories.

Correct answer: A. A) systemd-analyze blame

The systemd-analyze blame command displays the initialization time for each service during the boot process. This helps administrators identify and optimize slow services, whereas systemctl commands manage active units.

Correct answer: B. B) useradd

Useradd is correct because it directly creates a new user account in Linux. A common exam trap is choosing a fictional command like mkuser, whereas users only displays active login sessions and fuser identifies processes using files.

Correct answer: B. B) FreeBSD

FreeBSD is correct because it is a Unix-derived operating system, not a Linux distribution. While they share similarities, Linux distributions like Ubuntu and Fedora use the Linux kernel rather than a BSD kernel.

Correct answer: D. D) export

Export is correct because it manages environment variables for child processes and has no backup functionality. Remember that native utilities like tar, cpio, and rsync are the standard command-line tools for creating archives or synchronizing data.

Correct answer: D. D) Use the groupadd command.

Groupadd is correct because this is the standard Linux command to create a new user group. Be careful not to confuse it with chgrp, which only changes group ownership of existing files, or fictional commands like mkgroup.

Correct answer: A. A) group · B. B) user

User and group are correct because every Linux file assigns permissions specifically to an owning user and an owning group. The operating system does not define ownership categories for devices or systems, making those options invalid distractors.

Correct answer: B. B) /var/log

Most system and application log files are stored in the /var/log directory. Remember that /var holds variable data like logs that grow over time, whereas /etc stores static configuration files.

Correct answer: C. C) Kernel-level implementation of mandatory access control

SELinux implements mandatory access control at the kernel level to enforce strict security policies. Unlike standard Linux discretionary access control, MAC restricts actions based on system-defined labels.

Correct answer: B. B) Ping sweeps use ICMP Type 8 to Type 0 interactions, which are unreliable.

The correct answer works because ping sweeps rely on ICMP, which is frequently blocked by firewalls, making it an unreliable detection method. Port scans probe thousands of TCP or UDP ports, significantly increasing the chances of eliciting a response from a live system.

Correct answer: B. B) SSH

Secure Shell, or SSH, functions as a secure remote terminal emulation tool and can tunnel traffic to protect other communications. The other tools listed do not provide encrypted terminal access, making SSH the clear choice.

Correct answer: B. B) They set a file to execute as if a different user triggered the execution.

The SUID and SGID special permissions allow a file to execute with the credentials of the file owner or group owner rather than the user running it. Distractors about creating users or changing ownership describe useradd and chown instead.

Correct answer: A. A) the /home directory

The /home directory is the default storage location for personal user folders and profile data in Linux. Administrators often confuse this with the /usr directory, which actually stores system-wide user programs and libraries.

Correct answer: B. B) To evaluate network connectivity

The mtr command combines the functionality of ping and traceroute into a single interface to evaluate network connectivity. This makes it an essential diagnostic tool for identifying exactly where packet loss occurs along a route.

Correct answer: D. D) To check system binaries for rootkit modification

The chkrootkit utility scans local system binaries to detect known rootkit modifications. It operates strictly as a detection tool, whereas commands like chmod manage file permissions or SUID assignments.

Correct answer: D. D) pgrep

The pgrep command looks up and displays the process ID when you provide the process name. The kill command requires this PID to terminate the process, making these tools frequent companions.

Correct answer: A. A) rsync

Rsync is the correct choice because it efficiently synchronizes and backs up files across a network while preserving permissions. For the exam, associate tcpd with TCP wrapper monitoring and mcopy with MS-DOS file copying, not network backups.

Correct answer: D. D) hash

The hash command is correct because it is a bash built-in for caching command paths, not calculating file hashes. Remember that tools like md5sum and shasum generate cryptographic hashes to verify file integrity.

Correct answer: C. C) syslog

Syslog is correct because forwarding logs to a remote central server protects them from local tampering or deletion. Avoid confusing log management with tools like Wireshark or Nmap, which are used for network traffic analysis and mapping.

Correct answer: C. C) compgen

Compgen is correct because this bash built-in lists all available commands, functions, and aliases for the current user. The other options are basic utilities for displaying memory, files, or disk space rather than shell commands.

Correct answer: A. A) Use a grep command to search the /var/log/auth.log file.

Using grep is correct because it extracts specific text patterns from files, making it ideal for quickly filtering relevant entries from large logs. Opening logs in an editor is inefficient compared to command-line searching.

Correct answer: D. D) dm-crypt

The dm-crypt subsystem provides native transparent block device encryption for Linux. For the exam, remember that df reports filesystem space, fsck checks filesystems, and parted manages partitions without providing encryption.

Correct answer: A. A) The file will have r, w, and x set for the owner, r and x for the group, and read for the world.

The octal value 754 sets permissions to read, write, and execute for the owner, read and execute for the group, and read for the world. A quick exam cue is treating each digit as the sum of read (4), write (2), and execute (1).

Correct answer: A. A) iptables

The iptables utility functions as the default command-line firewall for Linux, filtering network traffic based on defined rule chains. Distractors fail because fsck repairs filesystems, nc handles network connections, and busybox provides tools.

Correct answer: B. B) grep

The grep command searches text using regular expressions and does not directly monitor or manage system processes. On the exam, remember that top displays active processes, while kill terminates them by their ID.

Correct answer: D. D) Avoid installing new updates on production systems.

The most critical patching practice is never deploying new updates directly on production systems without prior testing. Always validate patches in a test environment first to prevent unexpected downtime or security regressions.

Correct answer: D. D) Set account lockout policy.

The passwd command manages passwords and aging policies but cannot configure account lockout thresholds. Linux achieves account lockout functionality natively through pluggable authentication modules, rather than the standard passwd utility.

Correct answer: D. D) Use the ifconfig command.

The ifconfig command displays IP addresses and subnet masks on Linux systems. While ipconfig is a Windows command, ifconfig is the classic Linux equivalent you need to know for the exam.

Correct answer: D. D) tcpdump

Tcpdump is a command-line packet analyzer that captures network traffic for sniffing purposes. While nmap and hping3 are used for network discovery and scanning, tcpdump specifically collects raw packets.

Correct answer: D. D) cls

The cls command is a Windows utility used to clear the screen, not a Linux command. The Linux equivalent is clear, while commands like ls and chmod are native to Linux systems.

Correct answer: D. D) It deletes all possible files.

Executing rm -rf / as root recursively deletes every file on the system, destroying the operating system. The rm command removes files, the dash r makes it recursive, and the slash targets root.

Correct answer: D. D) The current folder is not defined in the PATH environmental variable.

The current folder is typically excluded from the PATH environmental variable to prevent malicious scripts from running accidentally. Using the dot slash prefix explicitly tells the system to execute the file locally.

Correct answer: A. A) Have ownership of the file. · B. B) Be the root.

To modify file permissions using chmod, you must either be the file owner or have root privileges. Standard users cannot change permissions for files they do not own without proper authorization.

Correct answer: C. C) Define hard coded mappings of all domain names to 127.0.0.1 in the /etc/hosts file.

Hardcoding all domain names to the loopback IP address in the hosts file breaks name resolution and prevents normal network access. Setting the hostname, verifying memory, and configuring the timezone are standard post-installation tasks.

Correct answer: B. B) Use suid. · D. D) Use sudo.

Configuring sudo access and setting the SUID bit both allow a binary to run with root privileges without requiring the root password. Remember that chmod is used to change permissions, while run as is a Windows concept.

Correct answer: B. B) process <daemon> reset

The phrase process daemon reset is not a valid Linux command for managing services. Valid historical methods include using the service command or calling the init.d scripts directly with start or stop arguments.

Correct answer: A. A) Servers · B. B) Client portable computers · C. C) Smart phones · D. D) Smart TVs

Linux is a highly versatile kernel that runs on a vast array of hardware, including servers, laptops, smartphones, and smart TVs. For the exam, recognize that Linux is not limited to traditional desktop or server environments.