GIAC GSEC QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE | |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,GIAC GSEC Practice Exam (100 Questions)
Domain 1: Defense in Depth & General Security Concepts
1. What is the primary goal of a Defense in Depth strategy?
A) To purchase the most expensive security tools
B) To rely on a single, strong perimeter firewall
C) To layer multiple security controls to protect assets
D) To outsource all security responsibilities
Answer: C
Rationale: Defense in Depth is a layered approach. If one control fails, another is in place to mitigate the threat.
Relying on a single control (like a firewall) is a single point of failure.
2. Which principle states that a user should be given only the minimum access necessary to perform their job?
A) Separation of Duties
B) Least Privilege
C) Need to Know
,D) Mandatory Access Control
Answer: B
Rationale: The Principle of Least Privilege dictates that users, programs, and systems should have only the
privileges essential to complete their required tasks, reducing the attack surface.
3. What is the difference between a vulnerability, a threat, and a risk?
A) They are all synonymous terms
B) A vulnerability is a weakness, a threat is a potential danger, and risk is the likelihood of a threat exploiting a
vulnerability
C) A threat is a weakness, a vulnerability is an attacker, and risk is the cost of a firewall
D) Risk is a weakness, a vulnerability is a potential danger, and a threat is the likelihood of an attack
Answer: B
Rationale: A vulnerability is a flaw (e.g., unpatched software). A threat is anything that can exploit it (e.g., a
hacker). Risk is the potential for loss when a threat exploits a vulnerability.
4. Which of the following is an example of a physical security control?
A) A firewall rule
, B) An Intrusion Detection System (IDS)
C) A locked server room door
D) A strong password policy
Answer: C
Rationale: Physical controls are measures to protect the physical environment. A locked door is a physical
control. Firewalls, IDS, and password policies are logical/technical controls.
5. What is the purpose of a security policy?
A) To describe the technical configuration of a firewall
B) To provide a high-level statement of management's intent and direction regarding security
C) To list all known vulnerabilities in the network
D) To serve as a step-by-step guide for incident response
Answer: B
Rationale: A security policy is a high-level document that defines the organization's security goals and rules.
Procedures and guidelines provide the detailed steps for implementation.
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE | |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,GIAC GSEC Practice Exam (100 Questions)
Domain 1: Defense in Depth & General Security Concepts
1. What is the primary goal of a Defense in Depth strategy?
A) To purchase the most expensive security tools
B) To rely on a single, strong perimeter firewall
C) To layer multiple security controls to protect assets
D) To outsource all security responsibilities
Answer: C
Rationale: Defense in Depth is a layered approach. If one control fails, another is in place to mitigate the threat.
Relying on a single control (like a firewall) is a single point of failure.
2. Which principle states that a user should be given only the minimum access necessary to perform their job?
A) Separation of Duties
B) Least Privilege
C) Need to Know
,D) Mandatory Access Control
Answer: B
Rationale: The Principle of Least Privilege dictates that users, programs, and systems should have only the
privileges essential to complete their required tasks, reducing the attack surface.
3. What is the difference between a vulnerability, a threat, and a risk?
A) They are all synonymous terms
B) A vulnerability is a weakness, a threat is a potential danger, and risk is the likelihood of a threat exploiting a
vulnerability
C) A threat is a weakness, a vulnerability is an attacker, and risk is the cost of a firewall
D) Risk is a weakness, a vulnerability is a potential danger, and a threat is the likelihood of an attack
Answer: B
Rationale: A vulnerability is a flaw (e.g., unpatched software). A threat is anything that can exploit it (e.g., a
hacker). Risk is the potential for loss when a threat exploits a vulnerability.
4. Which of the following is an example of a physical security control?
A) A firewall rule
, B) An Intrusion Detection System (IDS)
C) A locked server room door
D) A strong password policy
Answer: C
Rationale: Physical controls are measures to protect the physical environment. A locked door is a physical
control. Firewalls, IDS, and password policies are logical/technical controls.
5. What is the purpose of a security policy?
A) To describe the technical configuration of a firewall
B) To provide a high-level statement of management's intent and direction regarding security
C) To list all known vulnerabilities in the network
D) To serve as a step-by-step guide for incident response
Answer: B
Rationale: A security policy is a high-level document that defines the organization's security goals and rules.
Procedures and guidelines provide the detailed steps for implementation.
