GIAC Security Essentials GSEC 2026 Latest
Comprehensive Study Guide Cybersecurity
Fundamentals Review | Verified Answers | Detailed
Explanations | Success Workbook
Exam Reference: GIAC Security Essentials (GSEC) — SANS SEC401
Exam Details:
• Exam Code: GSEC
• Duration: 4 hours
• Questions: 106 questions
• Passing Score: 72% (73% for some exam versions)
• Format: Open-book, proctored (remote or onsite)
• CyberLive: Performance-based, hands-on lab tasks
• Cost: ~$1,099 (certification attempt only)
• Validity: 4 years
• Validity Period: 4 years
Exam Domains & Weighting:
Domain
1. Networking Fundamentals
2. Defense in Depth
3. Access Controls & Password Management
4. Cryptography
,Domain
5. Incident Handling and Response
6. Web Security
7. Operating System and Cloud Security
Total: 100%
Key 2026 Updates:
• CyberLive hands-on lab questions are now integrated into the exam
• Cloud Security — expanded coverage of AWS, Azure, and GCP operations
• Container and macOS Security — new topics added to the syllabus
• Passing score updated to 72% for exam versions released on or after April
6, 2026
• 106 questions over 4 hours with an open-book format
DOMAIN 1: NETWORKING FUNDAMENTALS (15%)
Question 1
A security analyst is analyzing a network capture and observes a packet with a
destination MAC address of FF:FF:FF:FF:FF:FF. What type of communication is
this?
A) Unicast
B) Multicast
C) Broadcast
D) Anycast
Answer: C
Rationale: A MAC address of FF:FF:FF:FF:FF:FF is the Ethernet broadcast
address. Frames sent to this address are delivered to all devices on the local
,network segment. Unicast (A) is a one-to-one communication with a specific MAC
address. Multicast (B) uses a range of MAC addresses starting with 01:00:5E for
IPv4 multicast. Anycast (D) is a network addressing and routing methodology
where datagrams are routed to the nearest or best destination.
Question 2
Which OSI model layer is responsible for routing packets across different networks
using logical addresses?
A) Layer 2 — Data Link
B) Layer 3 — Network
C) Layer 4 — Transport
D) Layer 7 — Application
Answer: B
Rationale: The Network Layer (Layer 3) is responsible for routing packets across
different networks using logical addresses (IP addresses). Layer 2 (Data Link)
handles communication within the same network using MAC addresses. Layer 4
(Transport) provides end-to-end communication services. Layer 7 (Application)
provides network services to user applications.
Question 3
A network administrator needs to allow a web server to be accessible from the
internet. Which ports must be open on the firewall for standard HTTP and HTTPS
traffic?
A) 20 and 21
B) 25 and 110
C) 80 and 443
D) 53 and 123
Answer: C
Rationale: HTTP uses port 80, and HTTPS uses port 443. Ports 20 and 21 (A) are
for FTP. Ports 25 and 110 (B) are for SMTP and POP3 email. Ports 53 and 123 (D)
are for DNS and NTP.
, Question 4
During a TCP three-way handshake, what is the correct sequence of flags
exchanged between a client and a server?
A) SYN-ACK, SYN, ACK
B) SYN, SYN-ACK, ACK
C) ACK, SYN, SYN-ACK
D) SYN, ACK, SYN-ACK
Answer: B
Rationale: The TCP three-way handshake sequence is: 1. Client sends SYN, 2.
Server responds with SYN-ACK, 3. Client sends ACK. This establishes a reliable
connection before data transmission begins.
Question 5
Which protocol is used to automatically assign IP addresses to devices on a
network?
A) DNS
B) ARP
C) DHCP
D) ICMP
Answer: C
Rationale: DHCP (Dynamic Host Configuration Protocol) automatically assigns
IP addresses and other network configuration parameters to devices. DNS (A)
resolves hostnames to IP addresses. ARP (B) resolves IP addresses to MAC
addresses. ICMP (D) is used for diagnostic and error messages (ping).
Question 6
A security analyst is examining a network packet and identifies the following
fields: source IP, destination IP, source port, destination port, and sequence
number. At which OSI layer is this information primarily found?
A) Layer 2 — Data Link
B) Layer 3 — Network
Comprehensive Study Guide Cybersecurity
Fundamentals Review | Verified Answers | Detailed
Explanations | Success Workbook
Exam Reference: GIAC Security Essentials (GSEC) — SANS SEC401
Exam Details:
• Exam Code: GSEC
• Duration: 4 hours
• Questions: 106 questions
• Passing Score: 72% (73% for some exam versions)
• Format: Open-book, proctored (remote or onsite)
• CyberLive: Performance-based, hands-on lab tasks
• Cost: ~$1,099 (certification attempt only)
• Validity: 4 years
• Validity Period: 4 years
Exam Domains & Weighting:
Domain
1. Networking Fundamentals
2. Defense in Depth
3. Access Controls & Password Management
4. Cryptography
,Domain
5. Incident Handling and Response
6. Web Security
7. Operating System and Cloud Security
Total: 100%
Key 2026 Updates:
• CyberLive hands-on lab questions are now integrated into the exam
• Cloud Security — expanded coverage of AWS, Azure, and GCP operations
• Container and macOS Security — new topics added to the syllabus
• Passing score updated to 72% for exam versions released on or after April
6, 2026
• 106 questions over 4 hours with an open-book format
DOMAIN 1: NETWORKING FUNDAMENTALS (15%)
Question 1
A security analyst is analyzing a network capture and observes a packet with a
destination MAC address of FF:FF:FF:FF:FF:FF. What type of communication is
this?
A) Unicast
B) Multicast
C) Broadcast
D) Anycast
Answer: C
Rationale: A MAC address of FF:FF:FF:FF:FF:FF is the Ethernet broadcast
address. Frames sent to this address are delivered to all devices on the local
,network segment. Unicast (A) is a one-to-one communication with a specific MAC
address. Multicast (B) uses a range of MAC addresses starting with 01:00:5E for
IPv4 multicast. Anycast (D) is a network addressing and routing methodology
where datagrams are routed to the nearest or best destination.
Question 2
Which OSI model layer is responsible for routing packets across different networks
using logical addresses?
A) Layer 2 — Data Link
B) Layer 3 — Network
C) Layer 4 — Transport
D) Layer 7 — Application
Answer: B
Rationale: The Network Layer (Layer 3) is responsible for routing packets across
different networks using logical addresses (IP addresses). Layer 2 (Data Link)
handles communication within the same network using MAC addresses. Layer 4
(Transport) provides end-to-end communication services. Layer 7 (Application)
provides network services to user applications.
Question 3
A network administrator needs to allow a web server to be accessible from the
internet. Which ports must be open on the firewall for standard HTTP and HTTPS
traffic?
A) 20 and 21
B) 25 and 110
C) 80 and 443
D) 53 and 123
Answer: C
Rationale: HTTP uses port 80, and HTTPS uses port 443. Ports 20 and 21 (A) are
for FTP. Ports 25 and 110 (B) are for SMTP and POP3 email. Ports 53 and 123 (D)
are for DNS and NTP.
, Question 4
During a TCP three-way handshake, what is the correct sequence of flags
exchanged between a client and a server?
A) SYN-ACK, SYN, ACK
B) SYN, SYN-ACK, ACK
C) ACK, SYN, SYN-ACK
D) SYN, ACK, SYN-ACK
Answer: B
Rationale: The TCP three-way handshake sequence is: 1. Client sends SYN, 2.
Server responds with SYN-ACK, 3. Client sends ACK. This establishes a reliable
connection before data transmission begins.
Question 5
Which protocol is used to automatically assign IP addresses to devices on a
network?
A) DNS
B) ARP
C) DHCP
D) ICMP
Answer: C
Rationale: DHCP (Dynamic Host Configuration Protocol) automatically assigns
IP addresses and other network configuration parameters to devices. DNS (A)
resolves hostnames to IP addresses. ARP (B) resolves IP addresses to MAC
addresses. ICMP (D) is used for diagnostic and error messages (ping).
Question 6
A security analyst is examining a network packet and identifies the following
fields: source IP, destination IP, source port, destination port, and sequence
number. At which OSI layer is this information primarily found?
A) Layer 2 — Data Link
B) Layer 3 — Network
