Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: In which file are password hashes stored on Unix and Linux systems?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- In which file are password hashes stored on Unix and Linux systems?
- How can the risk of malware infection be most significantly reduced?
- How does a system manage authorization through the use of RBAC?
- Which of the following is a single sign-on technology?
- What is the best means to blocking or preventing wireless network intrusions?
- In which phase of incident response would you disable a user account, remove a device from the network, or te…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. In which file are password hashes stored on Unix and Linux systems?
Answer: C. C) shadow
Linux and Unix systems store password hashes in the restricted shadow file to protect them from unauthorized access. The passwd file is readable by all users, so it only stores basic account details while omitting the actual hashes.
Q2. How can the risk of malware infection be most significantly reduced?
Answer: C. C) Alter user behaviors.
Altering risky user behaviors is the most effective way to reduce malware infections, especially against zero-day threats. Technical controls like encryption or authentication cannot stop malware if a user is tricked into executing it.
Q3. How does a system manage authorization through the use of RBAC?
Answer: D. D) A job label is placed on the user account.
Role-based access control assigns access privileges by placing a job or role label on a user account. This differs from discretionary control, which uses object-level lists, and mandatory control, which assigns security classifications.
Q4. Which of the following is a single sign-on technology?
Answer: A. A) Kerberos
Kerberos is a widely used single sign-on technology that allows users to authenticate once and access multiple services. Certificates and biometrics are individual authentication factors, while access control lists handle authorization.
Q5. What is the best means to blocking or preventing wireless network intrusions?
Answer: C. C) Enable WPA-2.
Enabling strong encryption like WPA2 or WPA3 provides the best defense against wireless intrusions. Other measures like MAC filtering or disabling SSID broadcasts offer minimal protection against determined attackers.
Q6. In which phase of incident response would you disable a user account, remove a device from the network, or terminate an employee?
Answer: B,C. B) Lessons learned || C) Eradication
The original answer keys eradication for removing offending elements like malicious accounts. However, disabling an active account to stop an attack in progress is a textbook containment action. The ambiguous wording makes containment an equally defensible correct answer on the exam.
Q7. How does a virus generally propagate?
Answer: B. B) Through user activities
Viruses generally propagate through user activities, requiring a host file to be executed. Worms distinguish themselves by self-replicating across networks, and Trojans trick users with benign facades.
Q8. Organizations need to make adjustments to improve their defenses against information warfare. What is the most important adjustment that is widely considered too difficult or impossible to actually implement?
Answer: B. B) Flattening an organization's hierarchical authority structure
Flattening hierarchical authority is considered the most critical but impractical defense against information warfare because rigid structures collapse if leadership is targeted. For the exam, associate distributed backups and encryption with standard best practices rather than difficult organizational shifts.
Q9. Why are multifactor authentication requirements essential to a robust security infrastructure?
Answer: C. C) It reduces the potential for impersonation.
Multifactor authentication reduces impersonation risk by forcing attackers to compromise multiple independent authentication factors. It does not inherently prevent data loss or verify accuracy, as those are handled by access controls and hashing.
Q10. How can an attacker trick a target system into accepting and then executing arbitrary code?
Answer: A. A) Submitting scripted input using meta-characters
Submitting scripted input using meta-characters can alter server-side execution, leading to arbitrary code execution in injection attacks. Pharming and hidden form field manipulation redirect users or alter client-side data without executing code.
Q11. Why are attacks and exploits such a concern when related to information warfare?
Answer: A. A) Asymmetric investment vs result
Information warfare is concerning because attackers can cause massive damage with very little investment. Standardized languages and operating systems might make targets easier to understand, but the primary concern remains the highly asymmetric ratio between cost and result.
Q12. The Mitnick-Shimomura attack is based on what weakness?
Answer: D. D) Predictable TCP sequence values
The Mitnick-Shimomura attack exploited predictable TCP sequence numbers to hijack a trusted session. Memorizing historical attacks is crucial for the exam, even though modern operating systems now generate sequence numbers randomly to prevent spoofing.
Q13. How can a company ensure that if they handle an incident internally which ends up involving the organization in a legal suit, they will have evidence which will be deemed admissible by the court?
Answer: A. A) Follow standard forensic procedures.
Following standard forensic procedures ensures evidence integrity and admissibility in court. Merely copying logs without hashing or improperly imaging drives breaks the chain of custody, making the evidence unusable during legal proceedings.
Q14. If a distributed denial of service (DDoS) attack is detected against your organization, how would you classify this type of information warfare in terms of its sophistication level, attacker type, and level of maturity? (Choose three.)
Answer: F,G,H. F) Sophistication level: Advanced || G) Maturity: Simple, easily accessed tools and not necessarily targeted || H) Maturity: Technically mature and developed by advanced hackers
DDoS attacks represent an advanced sophistication level within information warfare, utilizing technically mature tools developed by experienced hackers. Basic levels involve script kiddies, while top levels are advanced persistent threats.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.