GIAC GSEC Practice Test

Answer choices

1. A. Set every AP to maximum transmit power because stronger signals are always more secure, and validate coverage and authentication behavior after deployment
2. B. Place APs next to exterior windows so users receive the best signal in the parking garage, and validate coverage and authentication behavior after deployment
3. C. Perform a site/risk assessment that considers coverage boundaries, power, antenna placement, physical access, neighboring networks, and data sensitivity, then tune deployment accordingly
4. D. Disable wireless monitoring because it can reveal coverage information, and validate coverage and authentication behavior after deployment, while preserving the existing segmentation and change-control process

Wrong-answer review

• A. Set every AP to maximum transmit power because stronger signals are always more secure, and validate coverage and authentication behavior after deployment: Maximum power can expand the attack surface outside the intended area and increase interference.
• B. Place APs next to exterior windows so users receive the best signal in the parking garage, and validate coverage and authentication behavior after deployment: Deliberately extending coverage into public space contradicts the stated goal.
• D. Disable wireless monitoring because it can reveal coverage information, and validate coverage and authentication behavior after deployment, while preserving the existing segmentation and change-control process: Monitoring is part of WLAN security and helps identify rogue devices and anomalous conditions.

Answer choices

1. A. Ignore the vulnerability because a patch exists but has not yet been installed
2. B. Patch immediately on every server without testing, regardless of the stated availability constraint
3. C. Apply a tested temporary compensating control that removes or restricts exposure, schedule the patch/restart at the earliest approved window, and verify the service afterward
4. D. Change the daemon's banner string so scanners no longer identify the version, and stage the change through the normal maintenance workflow, and verify the resulting state against the approved hardening baseline

Answer choices

1. A. Leave SSH open from all corporate addresses permanently because administrators may need it again
2. B. Disable all NSG logging so the temporary change is not recorded, and retain the current centralized monitoring and change-control workflow, and verify the effective network or identity policy after deployment
3. C. Use a time-bounded approved access mechanism that opens the required management path only to the administrator's authorized source for the change window, then removes it
4. D. Assign Owner on the subscription to the administrator instead of changing network access, while limiting the change to the required service or cloud resource

Answer choices

1. A. Reconnect all systems first so remediation can be performed faster over the production network
2. B. Focus only on restoring files; vulnerability remediation should wait until the next annual audit
3. C. Remove persistence and malicious artifacts, remediate the exploited weakness across relevant systems, and reset compromised credentials
4. D. Delete SOC alerts associated with the incident so the rebuilt systems start with clean dashboards

Answer choices

1. A. Use technical severity as one input but incorporate exposure, asset criticality, exploit activity, compensating controls, and business impact to determine priority
2. B. Always remediate the higher CVSS score first, regardless of environment
3. C. Ignore CVSS entirely because vulnerability severity has no value
4. D. Prioritize whichever scanner found the issue first

Answer choices

1. A. Disable every camera on every corporate phone worldwide, and enforce the change through the existing managed-device policy, and monitor the resulting data-flow events through the current DLP console
2. B. Use managed application/data-flow controls and context-aware policy to keep work content within approved destinations while allowing permitted device functions
3. C. Permit unrestricted copy and share operations because the device is company-owned
4. D. Rely solely on a confidentiality banner shown when the phone is enrolled, while retaining enterprise logging and compliance reporting

Answer choices

1. A. Snapshots contain only empty disk blocks and never include application data
2. B. Snapshots are automatically anonymous because they are virtual rather than physical
3. C. Deleting the original VM cryptographically erases every snapshot copy in all repositories
4. D. They can preserve credentials, configuration, application data, and historical states that may remain exploitable even after the live VM changes

Answer choices

1. A. Place the private signing key on every verification workstation and keep the public key only on the signing server
2. B. Use one symmetric key on the signing server and every recipient workstation for both signing and verification
3. C. Protect the private signing key in the signing service and distribute only the public verification key to recipients
4. D. Publish both the private and public signing keys so verification remains available during outages

Answer choices

1. A. Remove deadlines entirely and let users postpone security updates forever, and monitor deployment health through the existing update reporting workflow
2. B. Force a random reboot each day so users cannot predict when updates apply
3. C. Use deployment deadlines, active-hours/restart notifications, and maintenance policy together so installation urgency and user disruption are deliberately managed
4. D. Disable update notifications because informed users are more likely to delay restarts, while preserving rollback and maintenance-window controls

Answer choices

1. A. ATT&CK is a behavior knowledge base used to map adversary techniques and defensive coverage; product evaluation should examine which techniques the product can observe or detect and under what conditions rather than treat ATT&CK as a compliance standard
2. B. ATT&CK certification proves a product blocks every listed technique
3. C. ATT&CK is a password policy standard, so EDR is outside its scope
4. D. A product is compliant if it uses the same technique numbers in its marketing materials