Practice for the GIAC Security Essentials (GSEC) exam with 13 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What protocol is used to resolve the MAC address of the device's interface used in communicating with a destination loca. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- What protocol is used to resolve the MAC address of the device's interface used in communicating with a desti…
- How does a bus topology differ from a star topology?
- Why would someone want to deploy an IEEE 802.11ac network rather than an IEEE 802.11g network?
- What benefit does the modulation concept introduced into wireless networking by IEEE 802.11n provide to high-…
- You are using a sniffer to monitor IP traffic. You notice a set of packets that make up a four-step communica…
- How does a caching DNS server resolve a query on behalf of a client for which it does not already know the an…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What protocol is used to resolve the MAC address of the device's interface used in communicating with a destination located in a distant subnet?
Answer: D. D) ARP
When communicating with a distant subnet, Address Resolution Protocol resolves the MAC address of the local default gateway. Devices do not send ARP broadcasts across a router to find the remote destination's MAC address.
Q2. How does a bus topology differ from a star topology?
Answer: D. D) A bus is a series of node connections, while a star consists of connections from nodes to a center device.
A bus topology connects nodes in a series along a single backbone cable, while a star topology links nodes to a central device. Remember that a mesh topology provides direct node-to-node connections.
Q3. Why would someone want to deploy an IEEE 802.11ac network rather than an IEEE 802.11g network?
Answer: C. C) 802.11ac provides throughputs up to 1 Gbps.
Deploying 802.11ac provides gigabit throughput speeds, significantly faster than older 802.11g networks. As a practical exam cue, remember that 802.11ac operates strictly in the five gigahertz band, avoiding two point four gigahertz interference.
Q4. What benefit does the modulation concept introduced into wireless networking by IEEE 802.11n provide to high-speed communications?
Answer: D. D) Multipath propagation
The multiple-input multiple-output modulation concept introduced by 802.11n uses multiple antennas to take advantage of multipath propagation. Instead of causing interference, bounced radio signals are tuned into unique transmission paths for faster data delivery.
Q5. You are using a sniffer to monitor IP traffic. You notice a set of packets that make up a four-step communication. The third packet in the set is a request packet, and it is sent from the client to the server. What operation or communicati…
Answer: B. B) DHCP leasing
The described four-step exchange represents the Discover, Offer, Request, and Acknowledgment sequence of a DHCP lease. If it were a TCP session establishment, you would only see a three-way handshake.
Q6. How does a caching DNS server resolve a query on behalf of a client for which it does not already know the answer?
Answer: C. C) It checks with a root DNS server, the global TLD DNS server, and the authoritative server.
A caching DNS server resolves unknown queries by sequentially asking root, top-level domain, and authoritative servers. Checking the cache is always the first step, but the prompt specifies the server does not already know the answer.
Q7. How does a sniffer capture all network traffic reaching an interface?
Answer: A. A) By disabling the MAC filter
A sniffer captures all traffic by placing the network interface card into promiscuous mode, which effectively disables the MAC address filter. This allows the system to read all frames on the local network segment, even those addressed to other devices.
Q8. How can data on a device be accessed by an attacker when Bluetooth is enabled?
Answer: A. A) Bluesnarfing
Bluesnarfing is the specific attack used to unauthorizedly access and steal data from a Bluetooth-enabled device. Bluejacking is often confused here, but it merely sends unsolicited messages rather than extracting sensitive information.
Q9. Which of the following is the best choice for deploying virtual machines as servers?
Answer: C. C) Bare metal hypervisor
Bare metal hypervisors, or Type 1 hypervisors, are installed directly onto server hardware without a host operating system. This provides better performance and security for server deployments compared to Type 2 hosted hypervisors.
Q10. How is the address assignment to systems different under IPv6 versus IPv4, as defined in their specifications?
Answer: D. D) Potentially, each interface will have three addresses assigned in IPv6, while they have one address assigned in IPv4.
Under the original IPv6 specifications, an interface can hold multiple addresses simultaneously, such as link-local, site-local, and global addresses. Be mindful that modern IPv6 deployment often relies on standard DHCP, making this distinction heavily focused on theoretical specifications rather than modern practice.
Q11. How does the recipient of a communication indicate that all of the elements of a communication set were received without corruption?
Answer: C. C) By sending an Acknowledgement flagged TCP segment with the acknowledgement number field set to a value that is one increment higher than the last received segment's sequencing number
The receiver sends a TCP segment with the Acknowledgement flag set, using a value one increment higher than the last sequence number. This confirms successful receipt and prepares the connection for the next expected byte.
Q12. What mechanism provides a live backup and restore feature for the guest OSs in a virtual machine environment?
Answer: A. A) Snapshot
Snapshots provide a quick, live backup and restore mechanism for running virtual machines, allowing admins to revert to a stable state. Standard drive imaging takes too long and is typically used for traditional physical servers rather than active virtualization.
Q13. Why is the WAN protocol PPP so important to modern networking?
Answer: C. C) Platform independence and interoperability
The Point-to-Point Protocol is important because it provides platform independence and interoperability across diverse vendor systems. While it supports authentication protocols like CHAP, its universal connectivity remains its defining legacy.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.