Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is the definition of a threat?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- What is the definition of a threat?
- What common attack method could let an attacker gain knowledge of secret information, access to digital syste…
- Why should biometrics be implemented as a multi-factor authentication component to be considered secure, inst…
- How should you respond to the fact that no single security mechanism is perfect and without compromise?
- What are the two primary reasons to define and enforce data classification?
- What responsibility related to managing and complying with a security policy is assigned to all workers withi…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is the definition of a threat?
Answer: C. C) Something that can cause harm to an asset
The correct answer works because a threat is defined as any potential danger that can cause harm to an asset. For the exam, remember that a vulnerability is a weakness, while risk is the likelihood that a threat will exploit that weakness.
Q2. What common attack method could let an attacker gain knowledge of secret information, access to digital systems, or even access into a physical environment?
Answer: D. D) Social engineering
The correct answer works because social engineering targets human vulnerabilities to gain access to systems, information, or physical spaces. Technical attacks like buffer overflows or SQL injection focus on software flaws and rarely grant physical entry.
Q3. Why should biometrics be implemented as a multi-factor authentication component to be considered secure, instead of as a single-factor system?
Answer: B. B) Scanning devices can be fooled.
The correct answer works because biometric scanning devices can often be fooled by false versions of a body part. Therefore, relying on biometrics as the sole authentication factor is risky without combining it with additional factors like passwords or tokens.
Q4. How should you respond to the fact that no single security mechanism is perfect and without compromise?
Answer: A. A) Implement defense in-depth.
The correct answer works because implementing defense in depth uses multiple overlapping security controls to protect assets. If one mechanism fails or is compromised, the remaining layers continue to provide protection against the attacker.
Q5. What are the two primary reasons to define and enforce data classification?
Answer: A. A) Authorization and defining security protection needs
The correct answer works because defining data classification establishes who is authorized to access information and determines its specific security protection needs. Classification is fundamentally an authorization mechanism, not an authentication or auditing tool.
Q6. What responsibility related to managing and complying with a security policy is assigned to all workers within the organization?
Answer: A. A) Reporting suspicious activity
The correct answer works because reporting suspicious activity is a universal responsibility assigned to all workers within an organization. Technical tasks like backing up servers or configuring encryption are delegated to specific administrative roles.
Q7. You use Snort as a rule-based intrusion detection system (IDS) on a Linux computer. Which of the following Snort rule actions would result in a packet being ignored by the IDS?
Answer: D. D) pass
The correct answer works because the pass action in a Snort rule explicitly tells the intrusion detection system to ignore matching packets. This prevents unwanted alerts when analyzing benign traffic that might otherwise trigger a rule.
Q8. What command is used to set permissions on Linux files?
Answer: A. A) chmod
The correct answer works because the chmod command is used to modify file mode bits, which control read, write, and execute permissions. Other commands like chown and chgrp only change file ownership or group association.
Q9. Why should a system administrator consider using or following the CIS Benchmark guide?
Answer: D. D) It includes recommended best practices for setting up and securing a Linux system.
The correct answer works because CIS Benchmarks provide established configuration baselines and recommended best practices for securely setting up systems. They focus on hardening operating systems against known vulnerabilities rather than improving performance.
Q10. Which account in Linux is the most powerful default account?
Answer: C. C) root
The root account is the most powerful default account in Linux, holding complete administrative control over the entire system. A quick exam tip is to associate root with Linux, while the administrator account belongs to Windows environments.
Q11. How can a system administrator determine if user credential attacks have been attempted against a specific Linux system?
Answer: D. D) View the contents of the /var/log/secure file.
Viewing the /var/log/secure file reveals authentication events, including failed logon attempts that indicate credential attacks. For the exam, remember that secure or auth logs are the primary sources for verifying login failures, whereas cron logs track scheduled tasks.
Q12. What feature of Linux enables it to support storage devices with a wide range of file systems?
Answer: D. D) VFS
The virtual file system, or VFS, enables Linux to support a wide range of file system formats by providing a standard interface. Avoid confusing this with SMB, which is used for sharing network resources rather than managing local storage compatibility.
Q13. Why would a Linux system administrator use Bastille Linux?
Answer: B. B) To be guided through a systematic security evaluation and hardening process
Bastille Linux guides administrators through a systematic security evaluation and hardening process rather than automatically applying settings. Do not confuse this with robust firewalls or web servers, as Bastille focuses primarily on interactive system configuration improvements.
Q14. What is the purpose of PAM?
Answer: C. C) To add modern, complex, multi-factor authentication options to Linux
Pluggable authentication modules, or PAM, add modern authentication options like multi-factor support to Linux. PAM does not modify password hashes or relocate them to the shadow file, it integrates advanced authentication mechanisms into the system.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.