Defense in Depth GSEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is security awareness training considered a critical layer in defense-in-depth?

   • ABecause it is required by all security frameworks
   • BBecause it eliminates the need for technical security controls
   • CBecause users are often the target of social engineering attacks
   • DBecause it ensures that all employees have strong passwords
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company runs a legacy web application that cannot be easily patched. The application is critical to business operations. The security team wants to protect it from known vulnerabilities while it remains in service. Which approach is most appropriate?

   • AIncrease logging and monitoring to detect attacks.
   • BDisable the application's unused features and services.
   • CPlace a web application firewall (WAF) in front of the application and use virtual patching to block known exploit patterns.
   • DIsolate the application on a separate network segment and restrict access to a small group of users.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services firm must protect customer data in transit and at rest. They also need to ensure that only authorized employees can access the data. Which combination of data security controls is most appropriate?

   • AEncrypt backup tapes and store them offsite.
   • BDeploy a data loss prevention (DLP) system to monitor outbound traffic.
   • CUse a VPN for remote access and require strong passwords.
   • DUse TLS for all data in transit, encrypt databases at rest, and implement role-based access control (RBAC).
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A data center operator wants to protect against an attacker who gains physical access to the building. Which combination of physical and logical controls would be most effective?

   • AUse smart card access for the building and disable USB ports on all servers.
   • BInstall CCTV cameras and rely on security guards to respond to alerts.
   • CUse a mantrap at the main entrance and place servers in an open-plan office for easy monitoring.
   • DInstall biometric access controls on server room doors and require multi-factor authentication for administrative console access.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary function of a web application firewall (WAF)?

   • ATo provide a virtual private network for remote users
   • BTo filter and monitor HTTP traffic between a web application and the internet
   • CTo manage user authentication and authorization
   • DTo encrypt data stored in a database
   Reveal Solution Discussion Select an answer first