Practice for the GIAC Security Essentials (GSEC) exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A host-based intrusion detection system triggers an alarm when a malicious attack takes place. What category of event is. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- A host-based intrusion detection system triggers an alarm when a malicious attack takes place. What category…
- A port probe is sent to a closed UDP port when no firewall is present. What is received by the port scanning…
- What is the risk of an XSS attack?
- How are NIDS and NIPS deployed in a large environment to obtain a network-wide perspective on the security st…
- When a port scanner reveals the open TCP and UDP ports on a target system, what information can be gleaned fr…
- Why is the final phase of penetration testing important, even though this type of security evaluation is only…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A host-based intrusion detection system triggers an alarm when a malicious attack takes place. What category of event is occurring?
Answer: D. D) True positive
A true positive occurs when a malicious attack triggers a detection system alarm. It is crucial to distinguish this correct alert from a false positive, where normal behavior is mistakenly flagged, or a false negative, where an actual attack is missed entirely.
Q2. A port probe is sent to a closed UDP port when no firewall is present. What is received by the port scanning tool?
Answer: C. C) An ICMP Type 3 Code 3
A closed UDP port without a firewall responds with an ICMP Type 3 Code 3 destination unreachable message. Remember that UDP lacks built-in session management, so systems rely on ICMP to signal that the target port is closed.
Q3. What is the risk of an XSS attack?
Answer: D. D) It poisons Web content.
Cross-site scripting attacks work by injecting malicious scripts into trusted web content, effectively poisoning the website. The strongest distractors describe delivery methods or unrelated attacks, whereas the core risk of this vulnerability is content manipulation.
Q4. How are NIDS and NIPS deployed in a large environment to obtain a network-wide perspective on the security status?
Answer: B. B) Implementing centralized analysis with numerous remote sensor agents
Large environments achieve network-wide visibility by deploying remote sensor agents that feed data to a centralized analysis engine. While connecting to a SPAN port is necessary for traffic capture, relying on isolated sensors prevents seeing the overall security picture.
Q5. When a port scanner reveals the open TCP and UDP ports on a target system, what information can be gleaned from this result?
Answer: A. A) The potential operating system and types of services running on the target
Open TCP and UDP ports reveal the potential operating system and the types of services running on a target machine. Security professionals use these port numbers to infer system characteristics, as specific services typically listen on well-known standard ports.
Q6. Why is the final phase of penetration testing important, even though this type of security evaluation is only a simulation of criminal activities?
Answer: D. D) It demonstrates an attacker's ability to mask their activities.
The final clearing tracks phase demonstrates an attacker's ability to mask their activities by altering or deleting logs. This step proves that standard logging is vulnerable to tampering, highlighting the need for protected centralized logging solutions.
Q7. Which of the following is NOT one of the means employed by an IDS or IPS to detect malicious events?
Answer: B. B) Initialization vector
An initialization vector is a cryptographic component used in encryption algorithms, not a detection mechanism used by intrusion detection or prevention systems. For the exam, associate detection methods with anomaly, behavioral, and heuristic analysis, leaving cryptographic terms separate.
Q8. What method of hacking or cracking Web applications infects a client system and piggybacks on a valid encrypted connection so that it can attack a Web service from inside?
Answer: A. A) CSRF
Cross-site request forgery works by hijacking a victim's authenticated session to submit unauthorized commands to a web server. Other options like SQL injection exploit database queries, whereas this attack specifically leverages the established trust of an active encrypted connection.
Q9. How can a vulnerability scan lead to a more secure environment?
Answer: C. C) Discovered weaknesses are secured by the IT staff.
Vulnerability scans improve security only when IT staff actively remediate the discovered weaknesses. Simply generating reports or performing routine scans provides no actual protection unless those identified flaws are properly mitigated and resolved.
Q10. What phase of penetration testing is LEAST likely to result in ethical attackers being detected by their target client?
Answer: C. C) Information gathering and reconnaissance
Information gathering and reconnaissance heavily rely on open-source intelligence, meaning attackers interact mostly with public resources rather than the target's monitored network. Active phases like scanning and exploitation trigger alerts, whereas passive research avoids direct detection.
Q11. What type of penetration test requires full documentation to be shared with the ethical attackers?
Answer: D. D) White box
A white box test provides ethical hackers with full knowledge and documentation of the target environment prior to the assessment. Black box testing offers zero prior knowledge, while grey box testing only discloses partial documentation to the evaluation team.
Q12. Which of the following is NOT a requirement for a client or target organization before a penetration test can be performed against them?
Answer: D. D) A recent security breach
Having a recent security breach is never a prerequisite for conducting a penetration test. Examiners expect you to know that organizations must possess mature security foundations, such as written policies and reliable backups, before authorized testing begins.
Q13. What is the risk when a user's website cookie is captured from network traffic?
Answer: D. D) Impersonation
A stolen cookie allows an attacker to impersonate the victim by reusing the active session token. Session hijacking enables immediate account access, unlike SQL injection or denial of service attacks.
Q14. Which of the following is a passive response of a host-based intrusion detection system?
Answer: D. D) Notify the administrator.
Notifying the administrator is passive because it does not interfere with the attacker or alter the system state. Active responses actively disrupt the attack, such as terminating processes or disconnecting sessions.
Q15. Why is filtering input by escaping meta-characters so important when attempting to prevent the cracking and attacking of web applications?
Answer: A. A) to defend against SQL injection
Escaping meta-characters neutralizes malicious injected commands, providing a primary defense against SQL injection attacks. Buffer overflows require bounded inputs for mitigation, making length filtering rather than character escaping the relevant control mechanism.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.