Practice for the GIAC Security Essentials (GSEC) exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is the main distinction between an NIDS and an NIPS?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- What is the main distinction between an NIDS and an NIPS?
- Which of the following is NOT a concern of a host-based IDS?
- Why is a host-based IDS or IPS system NOT considered as robust as a network-based solution?
- Which phase of a penetration test typically consumes the most time?
- What is the primary distinction between a honeynet and a honeypot?
- Why are honeypots a questionable legal concern when you are attempting to prosecute a suspect accused of atta…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is the main distinction between an NIDS and an NIPS?
Answer: A. A) One can stop an attack from becoming successful.
An intrusion prevention system can actively stop an attack from becoming successful, whereas an intrusion detection system generally only alerts on the activity. Remember that prevention systems sit inline to block traffic, while detection systems merely monitor.
Q2. Which of the following is NOT a concern of a host-based IDS?
Answer: A. A) Network topology
A host-based intrusion detection system monitors internal system activities like drive writes and active processes, not network topology. Network topology is strictly a concern for network-based intrusion detection systems, which require strategic sensor placement.
Q3. Why is a host-based IDS or IPS system NOT considered as robust as a network-based solution?
Answer: B. B) Host-based systems are dependent upon the stability of the OS.
Host-based security tools depend heavily on the stability of the underlying operating system, meaning an unstable or compromised system might disable the protection. Unlike network sensors, host agents operate as software processes and consume local resources.
Q4. Which phase of a penetration test typically consumes the most time?
Answer: B. B) Information gathering and reconnaissance
Information gathering and reconnaissance consumes the most time because testers must thoroughly research leaked data about the target. Remember that while exploitation gets the glory, discovery is the longest phase.
Q5. What is the primary distinction between a honeynet and a honeypot?
Answer: A. A) A honeynet includes multiple systems, while a honeypot includes only a single system.
A honeynet is simply a network constructed of multiple honeypot systems, whereas a honeypot is typically a single decoy system. Do not overthink logging capabilities; focus on the architectural scale difference.
Q6. Why are honeypots a questionable legal concern when you are attempting to prosecute a suspect accused of attacking your honeypot?
Answer: B. B) The honeypot is a false entity.
Honeypots are false entities, which makes prosecution tricky because courts might view them as entrapment or question the damages. Since the system is fake, proving actual harm is difficult.
Q7. What phase of penetration testing includes an operation to convert a standard user account's access into that of a higher privileged account?
Answer: C. C) Gaining access
Privilege escalation, converting standard access into higher privileges, occurs during the gaining access phase of a penetration test. Testers exploit vulnerabilities here to elevate their permissions after initial compromise.
Q8. In addition to detecting the identity of an attacker, what other forensic information may be discovered by a honeypot?
Answer: D. D) Details about a new unknown exploit
Honeypots are valuable for discovering details about new, previously unknown exploits or zero-day attacks. Since any traffic interacting with a honeypot is suspicious by default, analysts can safely analyze novel attack methods.
Q9. What additional concern should an organization have if a honeypot is discovered by hackers and is exposed in their community discussion forums?
Answer: C. C) Retaliation
Exposed honeypots often trigger retaliation because attackers actively target organizations that attempt to deceive them. Avoidance is unlikely since hackers rarely ignore a discovered system, whereas port scanning is just a precursor to larger retaliatory attacks.
Q10. Which of the following is NOT a key Web application defense used to prevent buffer overflows, SQL injection, and XSS?
Answer: A. A) Encrypting connections with TLS
Transport Layer Security only protects data in transit from eavesdropping and fails to validate server-side payload contents. Filtering input length, blocking known patterns, and escaping meta-characters actively inspect and sanitize data to prevent injection exploits.
Q11. Where is the LEAST appropriate location for positioning a honeypot?
Answer: A. A) In front of a public Web server
Deploying a honeypot near a public web server ruins the deception because attackers will target the legitimate resource instead. Honeypots are best placed in isolated server farms or near restricted internal access points like VPN concentrators.
Q12. What is the biggest risk related to using a vulnerability scanner?
Answer: B. B) False positives on the report
False positives represent the biggest risk because they waste valuable administrator time and resources during manual verification. A vulnerability scanner is a passive tool, so it discovers configurations and missing patches without actively exploiting or damaging targets.
Q13. Why is active content a risk when interacting with Web sites on the Internet?
Answer: A. A) Malicious code
Active content risks executing malicious code on a victim system because browsers run downloaded scripts with user privileges. While phishing and social engineering target human behavior, active content directly compromises the local machine through code execution.
Q14. How can an attacker initiate communication with and then compromise an internal client system protected by an application-level firewall without the firewall blocking the attack?
Answer: C. C) Use an unauthorized direct connection to the victim.
An attacker bypasses perimeter security by establishing an unauthorized direct connection to the victim. Application-layer firewalls inspect traffic deeply, so merely encapsulating payloads or encrypting the attack will still trigger alerts across monitored network paths.
Q15. What is the primary benefit of a firewall?
Answer: C. C) It discards all unnecessary traffic.
The primary benefit of a firewall is discarding unrecognized traffic by enforcing an implicit deny stance. While modern unified threat management appliances might handle caching or malware scanning, traditional firewalls focus strictly on traffic filtering and load balancing.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.