GIAC GSEC: GIAC Security Essentials

Last checked October 22, 2026 against the official GIAC exam page.

1. Question 1Access Control and Authentication

   A contractor needs access to a project share for a fixed two-week engagement. Which access approach best limits the exposure?

   1. AA shared domain administrator account for the team
   2. BPermanent discretionary ACL entries on the share
   3. CTime-limited role assignment that expires automatically
   4. DAnonymous guest access with a warning banner
   Show answer and explanationHide answer

   Correct answer: C

   A time-limited role grants access only for the engagement and removes it automatically, which limits standing privilege. Permanent entries and shared administrator accounts keep access open, and anonymous access removes accountability.

2. Question 2Cryptography

   What does a message authentication code (MAC) provide that a plain hash does not?

   1. AConfidentiality through public key encryption of the payload
   2. BKey exchange without prior trust between the two endpoints
   3. CNon-repudiation through a signed certificate chain in a PKI
   4. DIntegrity and authenticity using a shared secret key
   Show answer and explanationHide answer

   Correct answer: D

   A MAC is computed with a secret key, so only holders of the key can produce a valid tag, which proves authenticity as well as integrity. A plain hash lacks a key, and a MAC alone does not provide confidentiality or non-repudiation.

3. Question 3Network Security

   Which firewall type inspects application protocols and content, not just packet headers?

   1. AA stateless packet filter
   2. BAn application-layer (next-generation) firewall
   3. CA hub that repeats traffic to every port
   4. DA circuit-level proxy that relays connections without inspection
   Show answer and explanationHide answer

   Correct answer: B

   Application-layer and next-generation firewalls parse application protocols and enforce policy on content. Stateless filters examine headers only, circuit-level proxies relay without content checks, and hubs do not filter at all.

4. Question 4Security Operations and Incident Handling

   In the incident handling process, which phase directly follows containment?

   1. AEradication
   2. BDetection
   3. CPreparation
   4. DLessons learned
   Show answer and explanationHide answer

   Correct answer: A

   Eradication removes the attacker's access and malicious artefacts once the incident is contained. Preparation comes before incidents, detection precedes containment, and lessons learned closes the process.

5. Question 5Security Policy and Risk Management

   An organisation buys cyber insurance to cover financial losses from a breach. Which risk response does this represent?

   1. ARisk acceptance
   2. BRisk transfer
   3. CRisk avoidance
   4. DRisk mitigation
   Show answer and explanationHide answer

   Correct answer: B

   Insurance transfers the financial impact to another party. Acceptance keeps the risk, avoidance removes the activity that creates it, and mitigation reduces likelihood or impact through controls.