A company is designing a password policy for a system that stores highly sensitive data. The security team wants to protect against offline brute-force attacks and also reduce the risk of users reusing passwords across systems. Which policy is most effective?

Require passwords that are at least 8 characters and include a special character

Require long, unique passwords and use a password manager to generate and store them

Require complex passwords and change them every 30 days

Require users to use a biometric factor in addition to a password

An employee is transferred from the sales team to the finance team. What is the most appropriate account management action?

Grant the employee administrative rights to both teams

Keep the sales permissions and add finance permissions

Remove sales team permissions and grant finance team permissions

Delete the employee's account and create a new one

An organization wants to implement MFA for all administrative accounts. Which approach provides the strongest authentication?

Password and a hardware security key (FIDO2)

Password and a security question

Fingerprint and facial recognition

Which account lifecycle practice is most important when an employee leaves the organization?

Changing the user's password to a temporary one and leaving the account active

Disabling or deleting the user's account promptly

Transferring the account to another employee for continuity

Ignoring the account until the next audit

A company uses a shared document repository. The security team wants to ensure that only authorized users can access sensitive documents, and that access can be easily revoked when an employee leaves. Which mechanism is most suitable?

Access control matrix stored on the server

Access control lists (ACLs) on each document or folder

Mandatory access control (MAC) labels on each document

Capability tokens that users hold and present to the repository

GIAC Security Essentials

Domain 1Objective 1

Access Control & Password Management GSEC Practice Questions (Page 4)

Part of the Foundations of Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 16–20

16expert · hard
A company is designing a password policy for a system that stores highly sensitive data. The security team wants to protect against offline brute-force attacks and also reduce the risk of users reusing passwords across systems. Which policy is most effective?
Select an answer first
17application · easy
An employee is transferred from the sales team to the finance team. What is the most appropriate account management action?
Select an answer first
18application · medium
An organization wants to implement MFA for all administrative accounts. Which approach provides the strongest authentication?
Select an answer first
19foundation · easy
Which account lifecycle practice is most important when an employee leaves the organization?
Select an answer first
20expert · hard
A company uses a shared document repository. The security team wants to ensure that only authorized users can access sensitive documents, and that access can be easily revoked when an employee leaves. Which mechanism is most suitable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.