Free GSEC practice test: 30 questions with answers

A time-limited role grants access only for the engagement and removes it automatically, which limits standing privilege. Permanent entries and shared administrator accounts keep access open, and anonymous access removes accountability.

Biometrics such as fingerprints are inherence factors, or something you are. A password is something you know, a token is something you have, and location is a contextual attribute rather than a factor.

NIST SP 800-63B advises against routine forced rotation and recommends screening passwords against known breaches. Frequent rotation tends to produce predictable patterns, and the other options weaken security.

In discretionary access control the resource owner grants or revokes access. Mandatory access control enforces central labels, role-based control assigns permissions to roles, and attribute-based control evaluates attributes.

Multi-factor and hardware-backed credentials mean a stolen password alone does not grant access. Shared passwords, spreadsheets and unlimited attempts all increase the risk.

A MAC is computed with a secret key, so only holders of the key can produce a valid tag, which proves authenticity as well as integrity. A plain hash lacks a key, and a MAC alone does not provide confidentiality or non-repudiation.

A trusted certificate authority signs the certificate, and browsers trust it because the CA's root is in their trust store. DNS providers, session cookies and MX records have no signing role.

ECB encrypts each block independently, so repeated plaintext patterns remain visible in the ciphertext. GCM, CBC with a random IV and CTR with a unique nonce avoid this when used correctly.

Argon2 and bcrypt are deliberately slow and use per-user salts, which resists offline guessing. Unsalted MD5 is fast to brute force, AES with a co-located key is reversible, and Base64 is an encoding rather than protection.

Ephemeral key exchange such as ECDHE means each session key is independent of the long-term key, so a later key compromise does not expose earlier traffic. The other options are unrelated to session key secrecy.

Application-layer and next-generation firewalls parse application protocols and enforce policy on content. Stateless filters examine headers only, circuit-level proxies relay without content checks, and hubs do not filter at all.

Upstream scrubbing and edge rate limiting absorb or filter volumetric traffic before it exhausts the target. Disabling the firewall, local-only logging and password sharing do not help and add risk.

IPsec with IKE is the standard approach for site-to-site VPNs. PPTP has well-known cryptographic weaknesses, basic HTTP authentication is not a tunnel, and SNMP version 1 is a management protocol with weak community strings.

A DMZ, or screened subnet, isolates public-facing systems from internal networks. A flat network removes segmentation, a management VLAN carries device administration traffic, and a honeynet is a decoy environment.

Eradication removes the attacker's access and malicious artefacts once the incident is contained. Preparation comes before incidents, detection precedes containment, and lessons learned closes the process.

Capturing memory and recording connections preserves state that disappears on reboot. Rebooting, deleting temporary files and overwriting memory all destroy volatile evidence.

auditd and sudo records show which user executed privileged commands and when. Printer jobs, browser caches and DHCP offers do not record command execution by users.

Credential dumping from memory falls under the Credential Access tactic. Reconnaissance gathers information before an attack, Impact disrupts or destroys systems, and Initial Access is the point of entry.

Insurance transfers the financial impact to another party. Acceptance keeps the risk, avoidance removes the activity that creates it, and mitigation reduces likelihood or impact through controls.

Policies set roles and acceptable use at a principle level. Specific products, prices and presentation details belong in standards, procedures or procurement records.

NIST SP 800-53 organises security controls into families such as AC for access control and AU for audit. ITIL covers service management, COBIT is a governance framework, and ISO 9001 is a quality management standard.

Qualitative and semi-quantitative methods commonly combine likelihood and impact into a score. The other formulas are not standard ways of measuring risk.

Priority depends on exploit availability, reachability inside the network and business impact, and internal exposure still matters. Ignoring the finding, shutting the host down or disabling scanning are not sound responses.

An assessment catalogues weaknesses, and a penetration test validates exploitability within an agreed scope. Penetration tests are not limited to passwords, do not replace patching, and are often manual.

OWASP ZAP and Burp Suite are web application testing tools that detect injection and scripting flaws. Wireshark captures packets, Hashcat recovers password hashes, and Ansible automates configuration.

Risk-based prioritisation and an accurate inventory let teams fix the right systems first. Quarterly-only windows, breach-driven patching and disabling scans all delay or hide exposure.

644 gives the owner read and write, and the group and others read only. 777 grants everyone full access, 600 denies access to others, and 755 gives the owner full control while others can only read and execute.

netsh advfirewall shows the status of each firewall profile. chkdsk repairs disk errors, sfc checks protected system files, and gpupdate reapplies Group Policy.

visudo locks the sudoers file and validates syntax before saving, which prevents lockouts. Making the file world-writable, locking passwords and printing the shadow file are unsafe actions.

ss with the -l, -t, -n and -p options lists listening TCP sockets with their owning processes. The other commands list directories, show a login banner and print system details, but not listening sockets.