GIAC Security Essentials (GSEC)
Examination Questions And Correct
Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant
Download Pdf
1. A security administrator is configuring a firewall to enforce least privilege.
Which rule best supports this principle?
A. Allow all inbound traffic except known malicious ports
B. Deny all traffic by default and allow only required services
C. Allow all outbound traffic and restrict inbound traffic
D. Permit traffic based on MAC address only
B
A default-deny (implicit deny) policy enforces least privilege by blocking all
traffic unless explicitly allowed. This minimizes attack surface and prevents
unauthorized access paths. Other options either allow excessive traffic or rely on
weaker controls like MAC filtering, which is not scalable or sufficient for
network-layer security enforcement.
2. Which protocol provides secure remote shell access over an encrypted
channel?
A. Telnet
B. FTP
,C. SSH
D. HTTP
C
SSH (Secure Shell) encrypts session data, including authentication credentials
and commands, protecting against eavesdropping and man-in-the-middle
attacks. Telnet and FTP transmit data in plaintext, while HTTP is for web traffic
and not secure by default. SSH is the standard for secure administrative remote
access.
3. What is the primary purpose of hashing algorithms in cybersecurity?
A. Encrypt data for confidentiality
B. Ensure data integrity through fixed-length output
C. Compress data for storage efficiency
D. Authenticate users directly
C
Hashing is used to produce a fixed-length digest representing input data. It
ensures integrity by allowing verification that data has not been altered. Unlike
encryption, hashing is one-way and cannot be reversed. It is not used for
compression or direct authentication without additional mechanisms.
4. Which attack involves overwhelming a system with traffic from multiple
sources?
A. Phishing
B. Brute force
C. Distributed Denial of Service (DDoS)
D. SQL injection
D
,A DDoS attack uses multiple compromised systems to flood a target with traffic,
exhausting resources and causing service disruption. Unlike brute force or
phishing, which target credentials, DDoS focuses on availability by saturating
network or application capacity.
5. What is the main function of a VPN?
A. Encrypt stored files on disk
B. Provide secure communication over untrusted networks
C. Block malware execution
D. Monitor system logs
B
A VPN creates an encrypted tunnel over an untrusted network like the internet,
ensuring confidentiality and integrity of transmitted data. It does not directly
handle file encryption, malware blocking, or log monitoring, though it may
complement those controls.
6. Which port is commonly used for HTTPS traffic?
A. 21
B. 22
C. 80
D. 443
D
Port 443 is the standard port for HTTPS, which secures HTTP traffic using TLS
encryption. Port 80 is used for HTTP, port 22 for SSH, and port 21 for FTP. HTTPS
ensures confidentiality and integrity of web communications.
7. What does the principle of least privilege require?
, A. Users should have admin rights by default
B. Users receive only the permissions necessary to perform tasks
C. All users share the same access level
D. Permissions are granted permanently once assigned
A
Least privilege ensures users and systems are granted only the minimum access
required for their roles. This reduces attack surface and limits damage from
compromised accounts. Over-privileged accounts are a major security risk.
8. Which tool is commonly used for network packet analysis?
A. Wireshark
B. Nessus
C. Metasploit
D. Nmap
B
Wireshark captures and analyzes network packets in real time, helping identify
suspicious traffic, protocol issues, and potential intrusions. Nessus is a
vulnerability scanner, Metasploit is a penetration testing framework, and Nmap
is used for network discovery.
9. What is the purpose of multi-factor authentication (MFA)?
A. Replace passwords entirely
B. Require multiple verification methods for access
C. Encrypt user passwords in databases
D. Allow shared user accounts securely
C
MFA strengthens authentication by requiring two or more factors such as
something you know, have, or are. This reduces risk of compromise from stolen
Examination Questions And Correct
Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant
Download Pdf
1. A security administrator is configuring a firewall to enforce least privilege.
Which rule best supports this principle?
A. Allow all inbound traffic except known malicious ports
B. Deny all traffic by default and allow only required services
C. Allow all outbound traffic and restrict inbound traffic
D. Permit traffic based on MAC address only
B
A default-deny (implicit deny) policy enforces least privilege by blocking all
traffic unless explicitly allowed. This minimizes attack surface and prevents
unauthorized access paths. Other options either allow excessive traffic or rely on
weaker controls like MAC filtering, which is not scalable or sufficient for
network-layer security enforcement.
2. Which protocol provides secure remote shell access over an encrypted
channel?
A. Telnet
B. FTP
,C. SSH
D. HTTP
C
SSH (Secure Shell) encrypts session data, including authentication credentials
and commands, protecting against eavesdropping and man-in-the-middle
attacks. Telnet and FTP transmit data in plaintext, while HTTP is for web traffic
and not secure by default. SSH is the standard for secure administrative remote
access.
3. What is the primary purpose of hashing algorithms in cybersecurity?
A. Encrypt data for confidentiality
B. Ensure data integrity through fixed-length output
C. Compress data for storage efficiency
D. Authenticate users directly
C
Hashing is used to produce a fixed-length digest representing input data. It
ensures integrity by allowing verification that data has not been altered. Unlike
encryption, hashing is one-way and cannot be reversed. It is not used for
compression or direct authentication without additional mechanisms.
4. Which attack involves overwhelming a system with traffic from multiple
sources?
A. Phishing
B. Brute force
C. Distributed Denial of Service (DDoS)
D. SQL injection
D
,A DDoS attack uses multiple compromised systems to flood a target with traffic,
exhausting resources and causing service disruption. Unlike brute force or
phishing, which target credentials, DDoS focuses on availability by saturating
network or application capacity.
5. What is the main function of a VPN?
A. Encrypt stored files on disk
B. Provide secure communication over untrusted networks
C. Block malware execution
D. Monitor system logs
B
A VPN creates an encrypted tunnel over an untrusted network like the internet,
ensuring confidentiality and integrity of transmitted data. It does not directly
handle file encryption, malware blocking, or log monitoring, though it may
complement those controls.
6. Which port is commonly used for HTTPS traffic?
A. 21
B. 22
C. 80
D. 443
D
Port 443 is the standard port for HTTPS, which secures HTTP traffic using TLS
encryption. Port 80 is used for HTTP, port 22 for SSH, and port 21 for FTP. HTTPS
ensures confidentiality and integrity of web communications.
7. What does the principle of least privilege require?
, A. Users should have admin rights by default
B. Users receive only the permissions necessary to perform tasks
C. All users share the same access level
D. Permissions are granted permanently once assigned
A
Least privilege ensures users and systems are granted only the minimum access
required for their roles. This reduces attack surface and limits damage from
compromised accounts. Over-privileged accounts are a major security risk.
8. Which tool is commonly used for network packet analysis?
A. Wireshark
B. Nessus
C. Metasploit
D. Nmap
B
Wireshark captures and analyzes network packets in real time, helping identify
suspicious traffic, protocol issues, and potential intrusions. Nessus is a
vulnerability scanner, Metasploit is a penetration testing framework, and Nmap
is used for network discovery.
9. What is the purpose of multi-factor authentication (MFA)?
A. Replace passwords entirely
B. Require multiple verification methods for access
C. Encrypt user passwords in databases
D. Allow shared user accounts securely
C
MFA strengthens authentication by requiring two or more factors such as
something you know, have, or are. This reduces risk of compromise from stolen
