Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Why is a port scan more accurate at detecting the presence of a live system than that of a ping sweep?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- Why is a port scan more accurate at detecting the presence of a live system than that of a ping sweep?
- What Linux utility can be used as a secure remote terminal emulation tool or a VPN to protect other communica…
- What is the purpose of the Linux concepts of SUID and SGID?
- In which location will a system administrator locate the personal folders of users on a Linux system?
- Why would a user want to run the mtr command in Linux?
- Why would a Linux system manager use the chkrootkit command?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Why is a port scan more accurate at detecting the presence of a live system than that of a ping sweep?
Answer: B. B) Ping sweeps use ICMP Type 8 to Type 0 interactions, which are unreliable.
The correct answer works because ping sweeps rely on ICMP, which is frequently blocked by firewalls, making it an unreliable detection method. Port scans probe thousands of TCP or UDP ports, significantly increasing the chances of eliciting a response from a live system.
Q2. What Linux utility can be used as a secure remote terminal emulation tool or a VPN to protect other communications?
Answer: B. B) SSH
Secure Shell, or SSH, functions as a secure remote terminal emulation tool and can tunnel traffic to protect other communications. The other tools listed do not provide encrypted terminal access, making SSH the clear choice.
Q3. What is the purpose of the Linux concepts of SUID and SGID?
Answer: B. B) They set a file to execute as if a different user triggered the execution.
The SUID and SGID special permissions allow a file to execute with the credentials of the file owner or group owner rather than the user running it. Distractors about creating users or changing ownership describe useradd and chown instead.
Q4. In which location will a system administrator locate the personal folders of users on a Linux system?
Answer: A. A) the /home directory
The /home directory is the default storage location for personal user folders and profile data in Linux. Administrators often confuse this with the /usr directory, which actually stores system-wide user programs and libraries.
Q5. Why would a user want to run the mtr command in Linux?
Answer: B. B) To evaluate network connectivity
The mtr command combines the functionality of ping and traceroute into a single interface to evaluate network connectivity. This makes it an essential diagnostic tool for identifying exactly where packet loss occurs along a route.
Q6. Why would a Linux system manager use the chkrootkit command?
Answer: D. D) To check system binaries for rootkit modification
The chkrootkit utility scans local system binaries to detect known rootkit modifications. It operates strictly as a detection tool, whereas commands like chmod manage file permissions or SUID assignments.
Q7. Which command displays the PID for a specific process on a Linux system when the name of the process is known?
Answer: D. D) pgrep
The pgrep command looks up and displays the process ID when you provide the process name. The kill command requires this PID to terminate the process, making these tools frequent companions.
Q8. Which native command-line tool can a system manager use to back up data from a Linux system to a network-attached storage device?
Answer: A. A) rsync
Rsync is the correct choice because it efficiently synchronizes and backs up files across a network while preserving permissions. For the exam, associate tcpd with TCP wrapper monitoring and mcopy with MS-DOS file copying, not network backups.
Q9. Which of the following is NOT a command used to calculate or check file integrity on a Linux system?
Answer: D. D) hash
The hash command is correct because it is a bash built-in for caching command paths, not calculating file hashes. Remember that tools like md5sum and shasum generate cryptographic hashes to verify file integrity.
Q10. Which utility will assist with providing protection of Linux log files from alteration and destruction?
Answer: C. C) syslog
Syslog is correct because forwarding logs to a remote central server protects them from local tampering or deletion. Avoid confusing log management with tools like Wireshark or Nmap, which are used for network traffic analysis and mapping.
Q11. Which command can be used to display all of the commands and aliases available to a particular user on a Linux system?
Answer: C. C) compgen
Compgen is correct because this bash built-in lists all available commands, functions, and aliases for the current user. The other options are basic utilities for displaying memory, files, or disk space rather than shell commands.
Q12. You need to quickly analyze Linux log files to discover relevant information. Specifically, you need to find log entries that relate to a specific user related to questionable authentication events. What should you do?
Answer: A. A) Use a grep command to search the /var/log/auth.log file.
Using grep is correct because it extracts specific text patterns from files, making it ideal for quickly filtering relevant entries from large logs. Opening logs in an editor is inefficient compared to command-line searching.
Q13. Which of the following is a native Linux tool that can encrypt data storage?
Answer: D. D) dm-crypt
The dm-crypt subsystem provides native transparent block device encryption for Linux. For the exam, remember that df reports filesystem space, fsck checks filesystems, and parted manages partitions without providing encryption.
Q14. If the chmod 754 financial.xls command were issued, what would the result be?
Answer: A. A) The file will have r, w, and x set for the owner, r and x for the group, and read for the world.
The octal value 754 sets permissions to read, write, and execute for the owner, read and execute for the group, and read for the world. A quick exam cue is treating each digit as the sum of read (4), write (2), and execute (1).
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.