Sample Questions from GIAC Security Essentials (GSEC)

Preview a few questions below — answers are revealed when you take the exam.

1. A security team is tasked with implementing a new access control system for a multi-national corporation. The system must support role-based access control (RBAC) and attribute-based access control (ABAC) to manage permissions across various departments. What approach should they take to ensure both flexibility and security in the access control implementation?

   • Implement a hybrid access control system that combines RBAC for department-level permissions and ABAC for fine-grained access based on user attributes and environmental conditions.
   • Use only RBAC to simplify the access control model and reduce complexity, despite the limitations in handling dynamic access requirements.
   • Adopt a mandatory access control (MAC) model to enforce strict security policies, ignoring the need for flexibility in user permissions.
   • Create a custom access control system from scratch to meet all specific requirements, despite the higher development and maintenance costs.

2. Identify the command used in Linux to display the current network connections, including listening ports and their states.

   • A
   • B
   • C
   • D

3. Consider a scenario where an organization experiences a data breach due to a phishing attack. The incident response team needs to evaluate the effectiveness of their current security awareness training program. How should a professional assess the program's impact on employee behavior and identify areas for improvement?

   • Conduct a series of phishing simulation tests to measure employee susceptibility to phishing attacks and gather feedback through surveys to understand their awareness levels.
   • Rely solely on the number of reported phishing incidents to gauge the program's effectiveness, assuming fewer incidents indicate better awareness.
   • Implement a new security awareness training program without evaluating the current one, based on the assumption that all employees are equally aware.
   • Focus on technical controls to prevent phishing attacks, disregarding the importance of employee training and awareness.

4. What service is responsible for resolving human-readable domain names into IP addresses in a network?

   • A
   • B
   • C
   • D

5. A company is planning to deploy a new web application and needs to ensure it is secure against common vulnerabilities. What strategy should be applied when selecting a vulnerability assessment tool to scan the application for potential security flaws?

   • Choose a vulnerability assessment tool that offers both automated scanning and manual testing capabilities to cover a wide range of vulnerabilities.
   • Opt for a tool that only performs automated scans, assuming it will catch all vulnerabilities without the need for manual review.
   • Select a tool based solely on its price, without considering its effectiveness in detecting vulnerabilities.
   • Rely on the development team's code review process to identify vulnerabilities, without using any external tools.