Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What determines the class of an IPv4 address?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- What determines the class of an IPv4 address?
- What are the default service ports for the TLS encrypted form of FTP?
- What is the standard size of an IPv4 header if no options are set?
- What field in the TCP header is used to verify that received data was not corrupted or modified in transit?
- What term describes the function on a system receiving a network communication where the content of a header…
- What is the primary security benefit of operating multiple guest OSs in a virtual environment, as opposed to…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What determines the class of an IPv4 address?
Answer: D. D) Initial binary digits
The class of an IPv4 address is determined by its initial binary digits. Remember the leading bits: zero for Class A, one zero for B, one one zero for C, and so on, rather than relying on the subnet mask.
Q2. What are the default service ports for the TLS encrypted form of FTP?
Answer: C. C) TCP 989, 990
The TLS encrypted form of FTP, known as FTPS, uses TCP ports 989 and 990 by default. Do not confuse FTPS with SFTP, which operates over SSH on port 22, or standard FTP, which uses ports 20 and 21.
Q3. What is the standard size of an IPv4 header if no options are set?
Answer: A. A) 20 bytes
The standard size of an IPv4 header is 20 bytes when no options are set. The header length field usually indicates five 4-byte words, meaning five times four equals twenty bytes for your calculations.
Q4. What field in the TCP header is used to verify that received data was not corrupted or modified in transit?
Answer: B. B) Checksum
The checksum field is used to verify that received data was not corrupted or modified in transit. The acknowledgment number only confirms successful receipt of data, not its integrity against transmission errors.
Q5. What term describes the function on a system receiving a network communication where the content of a header is processed, the header is removed, then the payload is passed up to the next layer's appropriate protocol?
Answer: A. A) De-encapsulation
De-encapsulation describes processing a header, removing it, and passing the payload up to the next layer. This matches the OSI or TCP/IP model flow, whereas checksum verification is only a small step in that overall process.
Q6. What is the primary security benefit of operating multiple guest OSs in a virtual environment, as opposed to running multiple applications in a single OS?
Answer: B. B) Isolation of tasks and operations
The primary security benefit of operating multiple guest OSs is the isolation of tasks and operations. If one application is compromised, the hypervisor prevents the attacker from easily affecting the other isolated guest systems.
Q7. Why should the wireless encryption option of WPA be avoided when configuring a network?
Answer: D. D) It is based on RC4.
You should avoid WPA because it relies on the vulnerable RC4 streaming cipher. WPA2 provides a significant security upgrade by using the much stronger Advanced Encryption Standard, or AES, for protecting wireless communications.
Q8. What is the size of the original 2.4 GHz channels as defined by IEEE 802.11?
Answer: C. C) 22 MHz
The original IEEE 802.11 standard defined 2.4 GHz channels with a width of 22 MHz. Modern amendments like 802.11n and 802.11ac introduced channel bonding, allowing wider channels like 40 MHz to increase network throughput.
Q9. What is a description of Tcpdump?
Answer: C. C) A command-line raw packet-capturing utility
Tcpdump is a command-line raw packet-capturing utility used extensively in Linux and Unix environments. It is not a port listing tool like netstat, but rather a powerful utility for sniffing and analyzing network traffic.
Q10. When attempting to communicate with a service on a UDP port, your system receives a response of an ICMP Type 3 Code 3. Why did you receive this message?
Answer: B. B) Closed port
An ICMP Type 3 Code 3 message indicates a destination port is unreachable, meaning the UDP port is closed. Because UDP lacks internal error tracking, it relies on ICMP to notify senders of these delivery failures.
Q11. Why should inbound TCP and UDP 3389 be blocked on most networks?
Answer: C. C) To prevent remote control attacks
Port 3389 is used by Microsoft's Remote Desktop Protocol, which allows remote control of a system and poses a serious inbound security risk if exposed. Blocking it prevents attackers from establishing unauthorized remote control sessions, whereas the other options map to completely different ports.
Q12. Why is the three-way handshake performed by TCP at the start of each session?
Answer: A. A) To establish a session
The TCP three-way handshake synchronizes sequence numbers to reliably establish a session between two endpoints. A helpful exam tip is that basic network protocols do not handle authentication or encryption keys; those functions are left to the application or higher-level security protocols.
Q13. Which of the following TCP/IP layer to OSI layer mappings is incorrect?
Answer: D. D) Internetworking layer – Data Link layer
The TCP/IP Internetworking layer correctly maps to the OSI Network layer, making the Data Link mapping in the correct option fundamentally incorrect. When tackling model questions, always assume OSI is the default focus unless the question specifically calls out the TCP/IP or DARPA model.
Q14. What network device manages network traffic based on a 48-bit hardware address?
Answer: C. C) Switch
A switch operates at Layer 2 and makes forwarding decisions based on the 48-bit Media Access Control address found in Ethernet frames. Routers and firewalls function at higher layers using IP addresses, while a simple hub just repeats physical signals to all ports.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.