Practice for the GIAC Security Essentials (GSEC) exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is the primary tool used to secure Web communications?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- What is the primary tool used to secure Web communications?
- Which of the following is a security vulnerability that a vulnerability scan would be unable to detect?
- Which of the following is an advantage of a honeypot?
- How is a transparent proxy differentiated from a non-transparent proxy?
- What is the purpose of an attacker planting an unvalidated redirect or forward on a Web site?
- Where should the primary appliance firewall be positioned for maximum benefit?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is the primary tool used to secure Web communications?
Answer: C. C) TLS
Transport Layer Security is the primary protocol used to encrypt and secure web communications across the internet. Secure Shell manages remote administration, while IPsec secures virtual private network tunnels rather than individual web browsing sessions.
Q2. Which of the following is a security vulnerability that a vulnerability scan would be unable to detect?
Answer: B. B) Short and simple passwords
Vulnerability scanners generally cannot detect short and simple passwords because they do not perform brute-force authentication attacks. A separate password cracking tool is required to identify weak credentials, whereas scanners easily find missing updates.
Q3. Which of the following is an advantage of a honeypot?
Answer: D. D) Use of a honeypot can distract hackers from breaching live systems
A primary advantage of a honeypot is distracting attackers by drawing them toward a decoy system and away from live production servers. The other options represent significant deployment disadvantages, such as increased risk if a honeypot is fingerprinted.
Q4. How is a transparent proxy differentiated from a non-transparent proxy?
Answer: C. C) If the client software is configured to craft IP packets using a specific destination address
A non-transparent proxy requires the client software to be explicitly configured with the proxy server's address as the destination. A transparent proxy intercepts traffic automatically without client configuration, whereas user notification and NAT presence are irrelevant.
Q5. What is the purpose of an attacker planting an unvalidated redirect or forward on a Web site?
Answer: D. D) to trick victims into providing sensitive data
Attackers plant unvalidated redirects or forwards on a website to trick victims into visiting malicious sites and providing sensitive data. This stealthy redirection is often used for phishing rather than causing buffer overflows or cloning websites for offline viewing.
Q6. Where should the primary appliance firewall be positioned for maximum benefit?
Answer: A. A) At the primary ISP demarcation point
The primary appliance firewall provides the most benefit when positioned at the network edge, specifically the ISP demarcation point. This perimeter placement filters traffic before it enters the internal network, whereas internal devices rely on software firewalls.
Q7. How can an NIDS or NIPS potentially detect a new and unknown attack?
Answer: A. A) Behavioral, anomaly, and heuristic detection
Behavioral, anomaly, and heuristic detection mechanisms allow an intrusion detection system to identify new and unknown attacks. Instead of relying on known signatures, these methods evaluate deviations from a baseline to flag suspicious activity, though false positives may occur.
Q8. Which of the following items from a packet would a packet-filtering firewall use to make an allow or deny decision?
Answer: B. B) The source IP address and destination port number
A packet-filtering firewall operates at OSI layers three and four, making decisions based on the source IP address and destination port number. It does not inspect deep packet content or MAC addresses, which are features of higher or lower layer controls.
Q9. Which of the following is NOT a means to identify the type of host discovered during a vulnerability assessment?
Answer: B. B) IP address detection
An IP address alone merely confirms a device is active on the network, revealing nothing about its operating system or role. Port scanning, banner grabbing, and service enumeration actively probe the host to fingerprint its specific software and configuration.
Q10. Which of the following will secure Web communications against eavesdropping, hijacking, and man-in-the-middle attacks?
Answer: C. C) With mutual certificate authentication via TLS
Mutual certificate authentication via TLS stops man-in-the-middle attacks by requiring both the client and server to cryptographically prove their identities. Standard TLS without mutual authentication still leaves sessions vulnerable to clever interception and credential theft.
Q11. A retail Web site is experiencing problems where some purchases are not being properly charged. The site manager reviewed sales for the last few weeks and discovered several invoices where the customers were charged significantly less than…
Answer: B. B) The site allows hidden form fields.
Relying on hidden HTML form fields for pricing allows attackers to easily modify the price value locally before submitting the form. Servers must always retrieve prices from a secure backend database rather than trusting user-controllable client inputs.
Q12. What type of firewall is best suited for detecting and stopping port scans?
Answer: B. B) Stateful inspection firewall
Stateful inspection firewalls maintain context about active network connections, allowing them to easily recognize the rapid sequential probing typical of port scans. Static packet filters lack this contextual memory and cannot effectively correlate the individual probes.
Q13. What serious vulnerability that enabled attackers to steal information from supposedly protected systems, was discovered in OpenSSL?
Answer: C. C) Heartbleed Bug
The Heartbleed bug was a severe OpenSSL flaw allowing attackers to read protected system memory and steal encryption keys or plaintext data. Zeus and CryptoWall are malware families, while VENOM targeted virtual machine hypervisors.
Q14. Why is a TCP SYN scan the most effective form of port scanning, even when a packet-filtering firewall is present between the scanning system and the target system?
Answer: B. B) A SYN scan duplicates the connection request from a legitimate client.
A TCP SYN scan mimics the initial step of a legitimate connection request, making it stealthier than completing a full handshake. Because it closely resembles normal traffic, simple packet-filtering firewalls often fail to block it, allowing the scanner to detect open ports.
Q15. Which of the following is NOT a recommended secure Web application development practice?
Answer: D. D) Testing new code on a live Internet site
Testing new code on a live internet site introduces unnecessary risk, as unvetted changes can expose critical flaws to attackers. For the exam, remember that proper secure development lifecycle practices mandate strict separation of development, testing, and production environments.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.