Practice for the GIAC Security Essentials (GSEC) exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which systems or computers can a domain user account NOT log into?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- Which systems or computers can a domain user account NOT log into?
- Why is it important to establish a system baseline when performing system auditing and monitoring?
- Which of the following activities related to managing Windows networking security is NOT considered a form of…
- Which of the following can be used to view the hidden and administrative shares on a Windows system? (Choose…
- Why is stateful inspection such a useful feature in a firewall?
- In what phase of penetration testing are port numbers and IP addresses discovered via live interactive events?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which systems or computers can a domain user account NOT log into?
Answer: C. C) Workgroup clients
Domain user accounts are strictly managed by Active Directory, meaning they can only authenticate to systems within their own domain or a trusted domain. Workgroups operate as decentralized peer-to-peer networks without a central directory, so domain credentials are completely invalid there.
Q2. Why is it important to establish a system baseline when performing system auditing and monitoring?
Answer: C. C) It helps detect abnormalities.
Establishing a system baseline defines what normal network or system performance looks like, which is critical for identifying anomalies and potential security incidents. Administrators set warning thresholds based on deviations from this baseline, but baselining itself does not automatically prevent system downtime.
Q3. Which of the following activities related to managing Windows networking security is NOT considered a form of auditing?
Answer: B. B) Altering the authorization of user groups on shared resources
Auditing strictly involves monitoring, recording, and analyzing system activity to ensure security compliance. Altering user authorizations is an active system administration task that should be monitored by an audit trail, but it is not an auditing function itself.
Q4. Which of the following can be used to view the hidden and administrative shares on a Windows system? (Choose all that apply.)
Answer: C,D. C) Open the Shared Folders utility from Computer Management. || D) Open a command prompt, and type net share.
Administrative and hidden shares are not visible through standard network browsing or the Run dialog. To view these specific shares, administrators must use command-line utilities like net share or the Shared Folders management console.
Q5. Why is stateful inspection such a useful feature in a firewall?
Answer: A. A) It has knowledge of what constitutes legitimate communications.
Stateful inspection tracks the state of network connections, allowing the firewall to distinguish between legitimate traffic and malicious packets like unsolicited scans. Static packet filtering handles basic IP and port blocking, but lacks this connection awareness.
Q6. In what phase of penetration testing are port numbers and IP addresses discovered via live interactive events?
Answer: A. A) Scanning and enumeration
Scanning and enumeration actively probe a target network to map live IP addresses and discover open ports. Information gathering focuses on passive reconnaissance, while gaining and maintaining access occur after vulnerabilities are identified.
Q7. What type of VPN will provide protection for the communications between systems, but will NOT protect against an attacker learning the IP addresses of those participating in the transaction?
Answer: A. A) Transport mode VPN
Transport mode VPNs encrypt the payload but leave original IP headers visible. Use tunnel mode to encapsulate the original header and hide internal addresses during transmission.
Q8. When should a patch be installed?
Answer: C. C) After testing
Patches must be installed only after thorough testing to prevent production downtime. Installing immediately upon release risks breaking systems if compatibility issues exist.
Q9. Which of the following is NOT one of the default Windows event logs?
Answer: D. D) Users
Users is not a default Windows event log. Remember the classic triad of system, security, and application logs when analyzing Windows auditing and troubleshooting.
Q10. Which of the following is a mistake that would allow an attacker to gain access to the data on a BitLocker-encrypted storage device?
Answer: D. D) Configuring your system to auto-logon after booting
Configuring a system to auto-logon defeats the protection provided by full disk encryption. Once the system boots automatically, the decryption key is exposed to the logged-in account.
Q11. What is the one important security feature of password hashing that the NTLMv2 Windows algorithm does NOT have?
Answer: C. C) Salting
The NTLMv2 hashing algorithm does not use salting. Salting appends random values to passwords before hashing to mask duplicates, making cracking attacks significantly harder.
Q12. How many issues is a hotfix designed to address?
Answer: C. C) One
A hotfix is specifically designed to address only a single issue. Since hotfixes undergo less rigorous testing, it is generally recommended to wait for a fully tested cumulative update.
Q13. Why should an administrator subscribe to e-mail security bulletins?
Answer: D. D) To be notified automatically of issues concerning products under their management
Administrators subscribe to these bulletins to receive automatic notifications about critical issues affecting their managed products. This timely information is vital for protecting infrastructure from compromise.
Q14. The Audit Registry event is enabled for both Success and Failure in the Windows system's local security policy. Which additional setting must be made to enable the auditing of Registry access events?
Answer: C. C) Set an SACL on each Registry key to be monitored.
You must set a System Access Control List on each specific Registry key to be monitored. Simply enabling the master Audit Policy setting is insufficient without configuring the target objects.
Q15. You need to manage updates for enterprise Windows systems, including retrieving new updates from the public Microsoft server, quarantining updates until they are tested and approved by the network administrators, and distributing updates t…
Answer: A. A) WSUS
Windows Server Update Services provides the exact enterprise patch management capabilities described. It downloads updates, allows internal approval, and distributes them to native clients. Tools like MBSA only scan.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.