Practice for the GIAC Security Essentials (GSEC) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which two are examples of risk avoidance? (Choose two.). Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- Which two are examples of risk avoidance? (Choose two.)
- How can someone create a steganography-encoded message using just a text editor? (Choose two.)
- Which of the following is NOT likely a type of steganography?
- Why is symmetric encryption a challenge to implement as a stand-alone concept?
- Which of the following is NOT a steganography technique?
- How are the keys in an asymmetric encryption system generated?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which two are examples of risk avoidance? (Choose two.)
Answer: C,D. C) Removing an asset from the environment || D) Altering business processes
Risk avoidance involves changing business processes or completely removing an asset to eliminate the associated threat. Outsourcing is a classic example of risk transfer, while ignoring a threat is simply negligence, not a valid strategy.
Q2. How can someone create a steganography-encoded message using just a text editor? (Choose two.)
Answer: B,D. B) Craft a message so that every fourth word is the secret content. || D) Use whitespace encoding.
Using a concealment cipher or whitespace encoding allows hidden messages within text without requiring specialized graphical tools. Least significant bit manipulation applies to image or audio files, not standard ASCII text editing.
Q3. Which of the following is NOT likely a type of steganography?
Answer: B. B) A keystroke logger wrapped inside of a browser plug-in
A keystroke logger wrapped inside a browser plug-in is a Trojan horse, not steganography, because it focuses on malware delivery rather than hiding secret messages. Steganography requires concealing information within a carrier file without revealing its presence.
Q4. Why is symmetric encryption a challenge to implement as a stand-alone concept?
Answer: D. D) Secure key exchange
Secure key exchange is the primary challenge of symmetric encryption because both parties need the same key over an insecure medium. Asymmetric cryptography solves this through digital envelopes and key agreement protocols.
Q5. Which of the following is NOT a steganography technique?
Answer: A. A) Orthogonal frequency division multiplexing
Orthogonal frequency division multiplexing is a wireless modulation technique for encoding data onto multiple carrier frequencies, not a steganographic method. The other options represent legitimate ways to hide data within various media.
Q6. How are the keys in an asymmetric encryption system generated?
Answer: A. A) The private key is generated at random, and then the public key is derived from the private key.
In asymmetric cryptography, the private key is generated randomly, and the public key is derived from it using a one-way mathematical function. This prevents attackers from reverse-engineering the private key if they obtain the public key.
Q7. Which of the following is a protocol that can be used as a VPN solution?
Answer: C. C) TLS
Transport Layer Security (TLS) is correct because it is the foundational protocol for VPN solutions like OpenVPN. For the exam, remember that while SSH supports tunneling, Secure Copy (SCP) is only a file transfer utility and not a VPN protocol.
Q8. What is the purpose of sharing threat intelligence as related to risk assessment?
Answer: A. A) Equip other organizations to handle a looming security concern.
Sharing threat intelligence equips other organizations to proactively handle looming security concerns. Sharing is about collective defense and awareness, not about removing intellectual property ownership or attempting to trick attackers into abandoning exploits.
Q9. An organization has a properly implemented enterprise risk management (ERM). What is the tool used to list and categorize each discovered or encountered risk?
Answer: A. A) Risk register
A risk register is used to formally list, categorize, and track all discovered risks within an enterprise risk management program. It serves as an actionable tracking document, whereas threat models are used to evaluate specific vulnerabilities.
Q10. STRIDE is a threat assessment model used to evaluate the type and severity of a risk. Which of the following is a correct listing of the elements of STRIDE?
Answer: A. A) Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, Elevation of privilege
STRIDE correctly stands for Spoofing identity, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Use this mnemonic on the exam to quickly distinguish it from other models like DREAD, which focuses on damage and exploitability.
Q11. What is a valid description of risk deterrence?
Answer: D. D) Harming the threat agent
Risk deterrence involves discouraging attackers by threatening harm or retaliation, such as actively pursuing prosecution. For the exam, clearly distinguish this from risk mitigation, which focuses on implementing safeguards rather than threatening the threat agent.
Q12. Which type of cryptographic attack attempts to discover the unique symmetric key used to encrypt a data file when the algorithm is known?
Answer: A. A) Brute force
A brute force attack systematically attempts every possible key in the keyspace to find the exact symmetric key used for encryption. While dictionary attacks target passwords, brute force is the only method guaranteed to eventually find the specific key.
Q13. Why is least significant bit (LSB) steganography encoding difficult to detect?
Answer: C. C) It uses changed and unchanged elements to encode the hidden message
LSB steganography is exceptionally difficult to detect because it uses a mixture of changed and unchanged elements to encode hidden messages. This lack of a consistent alteration pattern prevents easy detection, unlike file size or hash value changes.
Q14. How can an organization properly defend against an accusation of ignoring a known risk?
Answer: D. D) Formal risk acceptance
Producing a document showing formal risk acceptance, signed by senior management, defends against accusations of ignoring a risk. Implementing countermeasures after the fact is too late, as proper risk management requires documentation before an incident occurs.
Q15. An organization responds to security violations only as they occur. What term describes the state or condition in which this organization operates?
Answer: D. D) Reactive state
A reactive state describes an organization that only addresses security incidents after they happen. The proactive state is the opposite, meaning the organization plans ahead and implements controls before a compromise occurs.
Q16. Why is a hash effective at detecting changes to a dataset across time?
Answer: B. B) The avalanche effect
The avalanche effect ensures that even a tiny change in the input data produces a significantly different hash output. While binary math is heavily used in cryptography, the avalanche effect specifically guarantees strict integrity violation detection.
Q17. Which of the following elements of cryptography is NOT used by the real-world cryptosystems of a VPN?
Answer: A. A) Static symmetric keys
Secure virtual private networks rely on ephemeral session keys rather than static symmetric keys, which are heavily vulnerable to interception. Hashing, digital signatures, and asymmetric key pair sets are all required components to establish secure tunnels.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.