An organization wants to implement multi-factor authentication (MFA) for remote access. The security team is concerned about phishing-resistant authentication. Which MFA factor combination is most resistant to phishing?

Password plus a time-based one-time password (TOTP) from an authenticator app

Password plus a WebAuthn security key that uses public-key cryptography and a per-site origin binding

Password plus an SMS one-time code

Password plus a push notification to a mobile app that the user approves

A company decides to deploy a password manager for all employees. The security team wants to ensure that the master password is not stored in plaintext and that the vault data is protected even if the password manager's cloud storage is breached. Which feature is essential?

Zero-knowledge architecture where the vault is encrypted with a key derived from the master password and never sent to the server

Two-factor authentication (2FA) enabled for the password manager account

A strong master password policy that requires 12 characters and complexity

Local-only storage of the vault with no cloud synchronization

What is the most significant security risk of storing user passwords in plaintext?

If the database is breached, attackers can directly read and use all passwords

Plaintext passwords take up more storage space than hashed passwords

Plaintext passwords cannot be used with multi-factor authentication

Plaintext passwords are harder to remember for users

A new employee joins the marketing team and needs access to the company's marketing automation tool. According to least privilege, what should the administrator do?

Grant the employee access to all marketing tools, including those used by other teams

Grant the employee administrative rights to the tool for flexibility

Grant the employee only the permissions required for their specific job duties

Grant the employee the same permissions as the most senior marketer

How does multi-factor authentication (MFA) enhance security beyond a password alone?

It ensures the user is in a specific geographic location

It requires the user to present two or more different authentication factors, reducing the risk if one factor is compromised

It eliminates the need for passwords entirely

It encrypts the password so it cannot be intercepted

GIAC Security Essentials

Domain 1Objective 1

Access Control & Password Management GSEC Practice Questions (Page 3)

Part of the Foundations of Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 11–15

11application · medium
An organization wants to implement multi-factor authentication (MFA) for remote access. The security team is concerned about phishing-resistant authentication. Which MFA factor combination is most resistant to phishing?
Select an answer first
12application · medium
A company decides to deploy a password manager for all employees. The security team wants to ensure that the master password is not stored in plaintext and that the vault data is protected even if the password manager's cloud storage is breached. Which feature is essential?
Select an answer first
13foundation · easy
What is the most significant security risk of storing user passwords in plaintext?
Select an answer first
14application · easy
A new employee joins the marketing team and needs access to the company's marketing automation tool. According to least privilege, what should the administrator do?
Select an answer first
15foundation · easy
How does multi-factor authentication (MFA) enhance security beyond a password alone?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.