Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What prevents an IP packet from being forwarded indefinitely when it encounters a routing loop?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- What prevents an IP packet from being forwarded indefinitely when it encounters a routing loop?
- A DHCP server fails to provide a Windows client with an IP address lease. What IP address may be used instead?
- What ICMP type is used by the tracert/traceroute tool to determine the IP addresses of the routers along a pa…
- Which protocol uses the service port of 587?
- What is the first field in a TCP header?
- What is the purpose of the DNS resource record type of PTR?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What prevents an IP packet from being forwarded indefinitely when it encounters a routing loop?
Answer: B. B) TTL
The Time to Live field in the IPv4 header is decremented by each router, ensuring packets are dropped if a routing loop occurs. Remember that Spanning Tree Protocol prevents Layer 2 loops, while the Time to Live field specifically protects Layer 3 routing.
Q2. A DHCP server fails to provide a Windows client with an IP address lease. What IP address may be used instead?
Answer: B. B) 169.254.0.1
When a Windows client fails to reach a DHCP server, it assigns itself an Automatic Private IP Addressing address from the 169.254 range. A strong exam cue is to associate the 169.254 prefix directly with DHCP failures, completely ignoring standard private or loopback addresses.
Q3. What ICMP type is used by the tracert/traceroute tool to determine the IP addresses of the routers along a path to a destination?
Answer: C. C) Type 11
Traceroute relies on ICMP Type 11, which is the Time Exceeded message, to map router hops. Do not confuse this with Type 0 Echo Replies used by ping, or Type 3 Destination Unreachable errors.
Q4. Which protocol uses the service port of 587?
Answer: A. A) SMTP
Port 587 is the modern submission port for SMTP, used by clients to send email securely. Port 25 is typically for server-to-server routing, while port 110 or 995 is used for retrieving email via POP3.
Q5. What is the first field in a TCP header?
Answer: C. C) Source port
The source port is always the very first field in a TCP header. For the exam, remember that Time to Live is an IP header concept, while the window size and acknowledgement number appear later in the TCP header.
Q6. What is the purpose of the DNS resource record type of PTR?
Answer: D. D) Link IP address to FQDN
A Pointer record links an IP address to a Fully Qualified Domain Name to support reverse DNS lookups. Address records perform the opposite function, resolving domain names to their respective IP addresses.
Q7. How is the network ID of an IP address identified?
Answer: B. B) By ANDing the subnet mask with the IP address
ANDing the subnet mask with the IP address mathematically reveals the network ID by dropping the host portion. Relying on legacy IP class assignments is invalid today due to variable length subnet masking.
Q8. What standard defines the 2.4 GHz wireless technology known as Bluetooth?
Answer: A. A) IEEE 802.15
The IEEE 802.15 standard defines Bluetooth, which operates in the 2.4 GHz frequency range for personal area networks. Do not confuse this with IEEE 802.11, which is the standard for standard Wi-Fi networks.
Q9. An SOA record stores seven details. Which detail is changed each time the zone file is updated on the primary authoritative DNS server?
Answer: B. B) Serial number
The serial number in a Start of Authority record must be incremented each time a zone file is updated. This tells secondary DNS servers that new information is available and a zone transfer is required.
Q10. What commonly used networking protocol adds a footer to the payload during encapsulation?
Answer: D. D) Ethernet
Ethernet adds a footer, known as the Frame Check Sequence, to the end of a payload during encapsulation to verify data integrity. Other common protocols like IP and TCP only use headers and lack this trailer.
Q11. At what layer or layers of the OSI model does a LAN protocol operate?
Answer: C. C) Physical and Data link layers
Local Area Network protocols like Ethernet operate at the Physical and Data Link layers of the OSI model. Remember that these bottom two layers handle physical connectivity and local hardware addressing.
Q12. Why is containment an essential step to perform before recovery can be initiated during the execution of an incident response policy?
Answer: D. D) To prevent further damage
Containment is performed before recovery to isolate affected systems and prevent further damage to the network. Identifying systems happens earlier, while evidence preservation is a forensic concern, not the primary containment goal.
Q13. Why would an organization choose to use the IP addresses from RFC 1918?
Answer: D. D) Internet isolation
RFC 1918 provides private IP addresses that are not routed across the public Internet, giving an organization natural internet isolation. For the exam, remember that private addressing inherently blocks inbound external traffic, though NAT is still required for outbound connectivity.
Q14. Which of the following is a public IP address?
Answer: B. B) 173.194.200.138
Only the 173.194.200.138 address falls outside the RFC 1918 private ranges, making it a valid public IP address. A strong exam cue is to immediately eliminate any option starting with the ten, 172.16 to 172.31, or 192.168 private ranges.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.