Practice for the GIAC Security Essentials (GSEC) exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: How does a honey token enable an investigator to track down an attacker?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- How does a honey token enable an investigator to track down an attacker?
- Why would a penetration tester use the nmap and hping tools during a penetration test?
- Which element of a Snort rule detects unwanted communication from a known malicious system?
- Which of the following is the most difficult action for an NIDS/NIPS to perform?
- Which location is the LEAST appropriate location to deploy a NIDS or NIPS?
- Why is an IPS considered a promising technology that is not yet fully realized?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. How does a honey token enable an investigator to track down an attacker?
Answer: A. A) By marking unauthorized communications
A honey token helps investigators track unauthorized activity by marking illegitimate communications with unique identifiers like fake credentials. If an attacker uses these trapped values elsewhere, the resulting alerts pinpoint the compromise without blocking access.
Q2. Why would a penetration tester use the nmap and hping tools during a penetration test?
Answer: B. B) to discover the status of port numbers and IP addresses
Penetration testers use network discovery tools like nmap and hping to identify active IP addresses and determine the status of port numbers. This scanning phase maps the attack surface, unlike gathering access or initial reconnaissance which relies on public sources.
Q3. Which element of a Snort rule detects unwanted communication from a known malicious system?
Answer: D. D) Source socket
The source socket identifies the origin of network traffic in a Snort rule, making it essential for detecting unwanted communication from known malicious IP addresses. The rule action then dictates whether to alert or drop that specific matching traffic.
Q4. Which of the following is the most difficult action for an NIDS/NIPS to perform?
Answer: A. A) Detect an attack before it is successful.
Predicting and preventing an attack before it executes is inherently difficult because prevention systems must make rapid decisions with minimal initial data. Notifying administrators or dropping suspicious sessions after detection are far simpler reactive tasks.
Q5. Which location is the LEAST appropriate location to deploy a NIDS or NIPS?
Answer: B. B) Outside the appliance firewall
Placing sensors outside the primary firewall exposes them to massive volumes of meaningless internet background radiation, causing extreme false positives. You want sensors positioned behind the firewall to inspect filtered traffic heading toward actual internal targets.
Q6. Why is an IPS considered a promising technology that is not yet fully realized?
Answer: C. C) It is unable to detect unknown attacks
Intrusion prevention systems struggle to reliably detect zero-day or unknown attacks because they primarily rely on known signatures and historical patterns. Blocking known malware signatures or abusive IPs is already highly effective and fully realized.
Q7. Why must a port scan be performed slowly and methodically to gain the most accurate information about the state of the ports on a target?
Answer: A. A) because of the potential presence of firewalls
Stateful firewalls detect port scans by tracking multiple rapid connection attempts from a single source over a short time window. Spacing out probes prevents triggering this threshold, ensuring the firewall drops your scanning traffic and blocks accurate results.
Q8. How can an attack against a client be overlooked by an NIDS that has a specific signature in its detection database of the attack being attempted?
Answer: A. A) Encrypt the connection.
Encrypting the connection blinds a network intrusion detection system because the sensor cannot decrypt the payload to inspect it for malicious signatures. If the NIDS lacks access to the session keys, it cannot evaluate the encrypted traffic contents.
Q9. Why should a security tester spend the time and effort to craft a network visibility map?
Answer: C. C) To confirm discovery of actual systems
Crafting a network visibility map confirms the discovery of actual systems deployed in the infrastructure, ensuring the assessment covers everything. This mapping process verifies that active scanning successfully found legitimate devices and missed nothing important.
Q10. What is the primary distinction between penetration testing and vulnerability scanning?
Answer: D. D) One relies upon manual attacks performed by skilled professionals
Penetration testing relies on manual attacks performed by skilled professionals to actively exploit vulnerabilities, whereas vulnerability scanning uses automated tools to identify weaknesses. Examiners emphasize that scanning finds flaws, while penetration testing actively exploits them.
Q11. Why should a Web browser be equipped with a plug-in or add-on to manage per-domain mobile code settings?
Answer: C. C) To minimize the risk of active content
Managing mobile code per domain minimizes the risk of malicious active content, like JavaScript, executing unchecked in the browser. Plugins restrict scripts to trusted sites, preventing automatic execution everywhere.
Q12. What common web application vulnerability occurs when the site includes CGI scripts borrowed from free online code repositories?
Answer: D. D) Backdoors
Borrowed scripts from free repositories often contain hidden backdoors providing unauthorized system access. Always review third-party code thoroughly before deployment to prevent hidden administrative logins.
Q13. Why is a static packet-filtering firewall not the proper type of firewall for protecting clients that periodically interact with the Internet?
Answer: B. B) Inbound ports are always open.
Static packet filters require inbound ports to remain open so clients can receive requested traffic. This exposes clients to arbitrary inbound connections, whereas stateful firewalls dynamically open ports only for valid sessions.
Q14. When a vulnerability scanner produces a report that has no findings, what does this mean?
Answer: A. A) The weaknesses of your environment are not discoverable with this tool.
A clean report only means the scanner did not find flaws within its specific detection database. Remember that no scanner is omnipotent; many vulnerabilities require manual discovery or are simply unknown to the tool.
Q15. What is a common constraint for consultants evaluating the security of a contracted client using a penetration test?
Answer: A. A) Do not steal funds out of company bank accounts.
Consultants are strictly constrained by law and ethics, meaning they cannot commit actual crimes like stealing funds from company bank accounts. While clients might initially prohibit social engineering or denial of service attacks, testers can negotiate those rules.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.