GCED Practice Questions

The first and most fundamental control to fail was data classification. Proper data classification would have identified the information on the server as "sensitive." This classification is a prerequisite for risk assessment and the subsequent application of appropriate security controls. Had the data been correctly classified, a risk assessment would have deemed it unacceptable to store such information on a legacy server with known, unpatchable vulnerabilities. This initial failure in classification led to the failure to apply other necessary controls, such as decommissioning the server, implementing compensating controls, or applying stricter access and monitoring rules, which ultimately enabled the breach.

A. Security awareness: This control relates to user behavior. The breach occurred through a technical OS vulnerability, not an action by an employee, making this an incorrect root cause.

B. Access control: While potentially weak, access control is a secondary control applied based on risk. The primary failure was the lack of a data classification that would have mandated stricter access controls.

D. Incident response: The failure of incident response (specifically, the lack of detection) occurred after the breach had already taken place. The question asks for the first control that failed.

---

1. NIST Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Reference: Section 2.3, "Control Selection Process," Page 16.

Quote/Concept: The document states that the control selection process is driven by "the security and privacy requirements from the mission and business functions that are to be supported by the system... and the criticality or sensitivity of the information processed, stored, and transmitted by the system." This establishes that identifying information sensitivity (i.e., classification) is a foundational step that precedes the selection and implementation of other controls.

2. MIT OpenCourseWare, Course 6.858 Computer Systems Security, Fall 2014.

Reference: Lecture 2 Notes, "Threat models," Section 2.

Quote/Concept: The lecture notes explain that a crucial first step in threat modeling is to "Identify assets." An asset is defined as something the defender wants to protect. The value of the asset (determined by classification) dictates the level of protection it warrants. Failure to properly value or classify the data asset means subsequent risk analysis and control implementation will be flawed from the start.

3. Ferraiolo, D. F., & Kuhn, D. R. (1992). Role-Based Access Control. 15th National Computer Security Conference.

Reference: Section 1, "Introduction."

Quote/Concept: This foundational paper on access control notes that policies are based on rules that "are established by a security policy administrator on the basis of the sensitivity of the information." This highlights that controls like access control are implemented as a result of understanding data sensitivity, which comes from classification.

Data classification is a foundational process in information security that involves categorizing data based on its level of sensitivity, value, and criticality to the organization. The primary benefit of this process is that it enables a risk-based approach to security. By identifying the most critical data assets, an organization can strategically focus its security budget, resources, and controls (such as encryption, access restrictions, and Data Loss Prevention (DLP) policies) where they are most needed. This appropriate allocation ensures that the most sensitive data receives the highest level of protection, directly reducing the risk of data loss.

A. While highly beneficial for effectiveness, not all DLP systems strictly require classification; many can function on predefined patterns (e.g., credit card numbers) alone.

B. This is a general statement about data states and does not explain the specific role or benefit of the data classification process.

C. Applying digital watermarks is a specific protective control that is enabled by classification, not the fundamental reason how classification helps prevent data loss.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations": The introductory text for the Access Control (AC) family states, "Access control policies (e.g., attribute-based, discretionary, mandatory, role-based) and associated access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are implemented by organizations to control access between subjects (i.e., users or processes acting on behalf of users) and objects (e.g., devices, files, records, network protocols, pipes, memory). The effectiveness of these policies and mechanisms depends on the successful identification, authentication, and authorization of subjects." Data classification is a prerequisite for defining these policies and mechanisms appropriately. This supports the concept of allocating controls based on data categorization.

2. University of California, Berkeley, Information Security Office, "Data Classification Standard": The standard's purpose section states, "Data classification is the foundation for a risk-based information security program. It allows campus to focus its limited resources on protecting its most sensitive and critical information assets." This directly aligns with the principle of allocating resources and controls appropriately. (Source: UC Berkeley Security, Data Classification Standard, Version 2.0, Page 2).

3. Carnegie Mellon University, Software Engineering Institute, "OCTAVE Allegro Information Asset Worksheet": The OCTAVE risk assessment methodology requires identifying and profiling critical information assets. The profile includes determining the asset's value and security requirements. This process, a form of data classification, directly informs which security controls and resources should be applied to protect the asset, illustrating the principle of appropriate allocation. (Source: CMU SEI, Introducing OCTAVE Allegro: A Risk-Based Approach to Information Security, Page 15).

The core of the issue is a misconfigured firewall rule. Firewalls are a fundamental technical mechanism for enforcing network access control policies. Their purpose is to permit or deny traffic between networks based on a defined rule set, thereby controlling access to resources. In this scenario, the firewall was intended to block access to Gmail for most users, but due to an error, it granted broad, unauthorized access. This represents a direct failure of the access control function to enforce the organization's security policy.

B. Authentication: This control verifies a user's identity (e.g., with a password). The problem was not that users were improperly identified, but what they could access once on the network.

C. Auditing: This control involves reviewing logs and records. The vulnerability assessment is a form of auditing that successfully detected the control failure; the audit process itself did not fail.

D. Rights management: This typically refers to more granular controls over specific data or application features (e.g., read/write/print permissions), not broad network-level access like a firewall provides.

1. NIST Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Section: Access Control (AC) Family.

Details: The AC family of controls is defined to "limit information system access to authorized users...and to the types of transactions and functions that authorized users are permitted to exercise." Control AC-4, "Information Flow Enforcement," specifically describes the use of policy enforcement mechanisms (like firewalls) at managed interfaces to control the flow of information. The scenario describes a failure in this exact function.

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.

Chapter 20, "Firewalls and Intrusion Prevention Systems," Section 20.1 "The Need for Firewalls."

Details: The text states, "In essence, a firewall is an access control device." It clarifies that a firewall's primary role is to act as a filter to enforce the access control policy of the organization between a trusted internal network and an untrusted external network.

3. MIT OpenCourseWare. (2014). 6.857 Network & Computer Security.

Lecture 15: Network Security & Firewalls.

Details: The course materials describe firewalls as a key component for enforcing a security perimeter. They function by inspecting network packets and using rules based on IP addresses and port numbers to block or permit traffic, which is a direct implementation of a network access control policy. A misconfiguration, as described in the question, is a failure of this policy enforcement.

The policy aims to prevent the exfiltration of data labeled "Company Proprietary". A Data Loss Prevention (DLP) system is the appropriate control. By configuring a DLP tool to perform deep packet inspection on outbound SMTP traffic, security analysts can scan the content of emails and their attachments for the specific keyword "Company Proprietary". When this string is detected, the system can log the event and alert the security team, allowing them to identify the policy breach. This method directly inspects the data content for the specific classification label defined in the policy.

A. Monitoring failed authentications is an access control measure and does not inspect the content of data being sent.

B. Enforcing TLS encryption protects data confidentiality during transit but does not prevent the data from being sent or identify policy violations.

C. Blocking based on file hashes is easily bypassed; it only works if the file is an exact, unmodified copy of a template.

1. National Institute of Standards and Technology (NIST) Special Publication 800-45 Version 2, Guidelines on Electronic Mail Security. Section 3.3.3, "Content Filtering," discusses how mail gateways can scan email messages and attachments for sensitive content based on keywords, patterns, or other attributes to enforce organizational policies.

2. Alneyadi, S., Al-Marridi, A., & Al-Dhaheri, A. (2016). Data Loss Prevention: A Comprehensive Survey. IEEE Communications Surveys & Tutorials, 18(3), 2271-2289. Section III-A, "Content Analysis Techniques," describes keyword matching as a fundamental method used by DLP systems to identify sensitive information within data streams by searching for specific words or regular expressions. (https://doi.org/10.1109/COMST.2016.2583009)

3. Carnegie Mellon University, Heinz College of Information Systems and Public Policy. Course 14-817: Information Security and Privacy, Lecture 10: Network Security. The courseware discusses network-based Data Loss Prevention (DLP) systems that monitor network traffic (e.g., SMTP, HTTP) to detect and prevent unauthorized data disclosures by inspecting content for sensitive keywords and patterns.

Modern security practices emphasize a "secure by default" posture to minimize the attack surface of a device. In line with this principle, newer versions of Cisco IOS and IOS XE ship with more non-essential services disabled by default. Services such as the HTTP server, finger, and various TCP/UDP small servers, which might have been enabled in older versions for administrative convenience, are now typically disabled. This forces administrators to explicitly enable only the services they require, reducing the number of open ports and potential vulnerabilities an attacker could exploit.

A. Telnet cannot be enabled or used: Telnet is still available for configuration in newer IOS versions for backward compatibility or specific use cases, although its use is strongly discouraged in favor of SSH.

B. The Cisco Discovery Protocol has been removed: The Cisco Discovery Protocol (CDP) remains a core, proprietary feature in Cisco IOS and is used for device discovery. It has not been removed from the operating system.

D. Two-factor authentication is default required: While newer IOS versions have robust support for two-factor authentication (2FA) via TACACS+ and RADIUS, it is not a default requirement and must be explicitly configured by an administrator.

1. Cisco Systems, Inc. (2023). Cisco Guide to Harden Cisco IOS Devices. This guide explicitly states, "Many services are enabled by default on Cisco IOS devices, some of which are not required in a regular network deployment. Every service that is running on a device is a potential attack vector." It then provides instructions for disabling services like ip finger, ip http server, and TCP/UDP small servers, which reflects the modern best practice of disabling services that are now off by default in newer releases. (Reference: "Unneeded Services" section).

2. Cisco Systems, Inc. (2023). Cisco IOS XE Security Configuration Guide, Release 17.x. In the "Configuring the HTTP Server and Client Services" chapter, the documentation for the ip http server command states, "The secure HTTP server is disabled by default." This is a specific example of a service being disabled by default in a modern IOS version to reduce the attack surface, contrasting with older versions where it was often enabled. (Reference: "HTTP Server and Client Services" section, Command Defaults).

3. Cisco Systems, Inc. (2023). Cisco IOS XE Security Configuration Guide, Release 17.x. The guide's section on "Securing User Services" details the configuration of Telnet and SSH. It confirms that Telnet is still a configurable option, stating how to create a Telnet-only access class, which would be impossible if the service were removed. (Reference: "Configuring Secure Shell" and "Configuring Telnet" sections).

The creation of a filesystem timeline is a foundational technique in digital forensic analysis. By extracting and correlating file metadata—specifically Modified, Accessed, Created, and Change (MACC) timestamps—investigators can reconstruct a chronological sequence of events on a system. This timeline is essential for understanding an attacker's actions, such as when a malicious file was introduced, when data was exfiltrated, or when system files were altered. The primary objective is to analyze evidence to determine the scope and details of an incident, which is the core purpose of the forensic analysis phase.

B. First response: This phase focuses on initial evidence preservation (e.g., disk imaging) and containment, not the in-depth analysis required to build and interpret a timeline.

C. Access control: This is a preventative security measure to manage user permissions and restrict access to resources, which is unrelated to post-incident investigation.

D. Incident eradication: This phase involves removing the threat from the environment. Timeline analysis is the preceding step that identifies what needs to be eradicated.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.3, "Timeline Analysis," explicitly states, "One of the most useful things that an investigator can do during a forensic analysis is to create a timeline of events from the compromised system."

2. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Chapter 11, "Timeline Analysis," is dedicated to the process of creating timelines from file system metadata to reconstruct events for a forensic investigation.

3. Maras, M. H. (2014). Computer Forensics: Cybercriminals, Laws, and Evidence (2nd ed.). Jones & Bartlett Learning. Chapter 7, "Digital Forensics Analysis," describes timeline analysis as a key method for "reconstructing the events that transpired" during the analysis phase of an investigation.

4. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press. Chapter 10, "Analysis and Correlation," discusses timeline analysis as a critical technique for correlating disparate data points to understand the sequence of events in a forensic case.

An Nmap connect scan (-sT) uses the operating system's high-level connect() system call to establish a full connection to a target port. This process precisely follows the standard TCP three-way handshake. The scanner initiates by sending a SYN packet. If the port is open, the target responds with a SYN/ACK packet. The scanner's OS completes the handshake by sending an ACK packet. A successful completion of this handshake indicates the port is open. Because a full connection is established, this scan type is easily detectable and logged by the target system.

A. This sequence describes a SYN scan (-sS) or "half-open" scan, where the connection is reset before being fully established to avoid logging.

B. The expected response from an open port to an initial SYN packet is a SYN/ACK, not a standalone ACK.

C. This is not a valid TCP connection establishment sequence; a client does not send a SYN/ACK after receiving an ACK.

1. Official Nmap Documentation: Lyon, G. (n.d.). Port Scanning Techniques. Nmap Network Scanning. Retrieved from https://nmap.org/book/man-port-scanning-techniques.html. In the "TCP connect scan (-sT)" section, it states, "Nmap asks the underlying operating system to establish a connection... This is the same high-level system call that web browsers, P2P clients, and most other network-enabled applications use to establish a connection. ... If the port is open, the connect() call will succeed". The success of the connect() call is predicated on the completion of the three-way handshake (SYN, SYN/ACK, ACK).

2. University Courseware: Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 3, Section 3.5.3, "TCP Connection Management," the text details the three-way handshake for connection setup: "Step 1: The client-side TCP first sends a special TCP segment to the server-side TCP. ... This special segment contains no application-layer data. It does, however, have one of the flag bits in the segment’s header, the so-called SYN bit, set to 1." "Step 2: ... the server TCP sends a special TCP segment of its own." "Step 3: ... the client again sends another special segment." This sequence corresponds to SYN, SYN/ACK, and ACK.

3. University Courseware: Balakrishnan, H. (2018). Lecture 13: Networking III: TCP. MIT OpenCourseWare, 6.033 Computer System Engineering, Spring 2018. Slide 13 explicitly diagrams the "TCP 3-way Handshake" as Client (sends SYN) -> Server (sends SYN+ACK) -> Client (sends ACK).

NetworkMiner is a Network Forensic Analysis Tool (NFAT) specifically designed for parsing pcap files to extract application-level data and artifacts. A core, native feature of NetworkMiner is its ability to automatically carve files, including various image formats (e.g., JPG, PNG, GIF), from captured network traffic. It then presents these extracted files in a user-friendly graphical interface, conveniently grouped under dedicated tabs such as "Images" and "Files." This directly fulfills the analyst's requirement to see a grouping of images contained within a pcap file without needing to write scripts or perform complex manual extractions.

A. Scapy is a powerful packet manipulation library for Python. It requires custom scripting to dissect protocols and reassemble files, lacking a native, built-in interface for grouping images.

C. TCPReplay is a utility for replaying captured network traffic from a pcap file back onto a network. It does not perform any analysis or artifact extraction.

D. Wireshark is a network protocol analyzer. While it can export objects from HTTP streams, this is a manual process and not its primary function, nor does it provide the automatic, categorized grouping that NetworkMiner does.

1. Netresec AB, "NetworkMiner," Official Vendor Documentation.

On the official features page, it states: "NetworkMiner can extract files, images, emails and certificates from network traffic... The extracted artifacts are grouped per host in the 'Files' and 'Images' tabs." This confirms the native capability to extract and group images. (Reference: netresec.com/?page=NetworkMiner, Features Section)

2. Al-khassaweneh, M., & Othman, S. M. B. H. (2013). A Comparative Study of Network Forensic Tools. International Journal of Computer Applications, 78(11), p. 3.

This academic paper compares network forensic tools and notes, "NetworkMiner is a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also extract files and certificates from pcap files." This highlights its primary design for artifact extraction.

3. Scapy Documentation, "Introduction," scapy.readthedocs.io.

The official documentation introduces Scapy as: "a powerful Python-based interactive packet manipulation program and library... It can forge or decode packets of a wide number of protocols, send them on the wire, capture them..." This establishes it as a library requiring programming, not a tool with a native GUI for image grouping. (Reference: scapy.readthedocs.io/en/latest/introduction.html#what-is-scapy)

4. Wireshark User's Guide, Chapter 7. Exporting.

The documentation describes the "File → Export Objects" menu, which allows users to save objects from protocols like HTTP, SMB, or TFTP. This confirms the feature exists but as a manual export function, distinct from the automatic parsing and grouping paradigm of NetworkMiner. (Reference: Wireshark User's Guide, Section 7.8, "Exporting Objects")

The provided text is a classic example of a SQL Injection (SQLi) attack. The attacker is appending malicious SQL code to an existing query. The UNION SELECT clause is used to combine the results of the original, legitimate query with a new, attacker-controlled query. The INTO OUTFILE clause, specific to databases like MySQL, attempts to write the output of this combined query to a file on the web server's filesystem (/tmp/file1.txt). The trailing -- is a comment operator in SQL, used to nullify the rest of the original application's query to prevent syntax errors.

A. Remote File Inclusion: This attack involves tricking an application into including and executing a file from a remote URL, which is not present in this payload.

B. URL Directory Traversal: This attack uses sequences like ../ to access files outside of the intended directory, which are not used in the provided string.

D. Binary Code in HTTP Headers: The payload is text-based SQL syntax, not executable binary code, and is typically sent in a URL parameter or POST body.

1. MySQL 8.0 Reference Manual: The official MySQL documentation describes the syntax and function of the clauses used in the attack.

Section 13.2.10.1, SELECT ... INTO Statement: "The SELECT ... INTO OUTFILE 'filename' form of SELECT writes the selected rows to a file." This confirms the file-writing behavior.

Section 13.2.10.3, UNION Clause: "UNION is used to combine the result from multiple SELECT statements into a single result set." This confirms the query manipulation technique.

2. Stanford University, CS 155: Computer and Network Security, Lecture 5: This courseware details web security vulnerabilities.

Slide 20, "SQL Injection Example": The lecture illustrates how attackers can use SQL injection to bypass authentication or extract data, using techniques like appending OR 1=1 -- to a query. The provided attack string is a more advanced variant of this fundamental concept.

3. Halfond, W. G., Viegas, J., & Orso, A. (2006). A classification of SQL-injection attacks and countermeasures. Proceedings of the International Symposium on Secure Software Engineering: This peer-reviewed paper provides a taxonomy of SQLi attacks.

Section 2.1.1, Tautologies and Union Query: The paper describes "Union Query" as a type of SQLi where an attacker "appends a UNION SELECT statement to the original query... to extract information from other tables in the database." This directly matches the technique seen in the question. (DOI: https://doi.org/10.1109/ISSSE.2006.24)

The most accurate statement is that classification of information assets is a foundational control for mitigating insider threats. Data classification is the process of categorizing data based on its sensitivity, criticality, and value to the organization. This process is essential because it allows an organization to understand which assets are most important to protect. Once critical assets are identified, appropriate security controls—such as principle of least privilege, access controls, and data loss prevention (DLP) policies—can be applied in a targeted and cost-effective manner to protect them from unauthorized insider access, modification, or exfiltration.

B. Security awareness programs are a critical control for reducing insider threats, especially those stemming from negligence or unintentional actions, which constitute a large portion of incidents.

C. Detective controls (e.g., log review, audits) are designed to identify and respond to an attack after it has occurred or is in progress; they do not prevent it.

D. Rotation of duties is a well-established administrative control designed to decrease the likelihood of an insider threat by preventing any single individual from maintaining long-term, unchecked control.

E. Separation of duties is a principle that divides critical tasks among multiple employees to ensure no single person has excessive control, thereby preventing fraud and error.

1. Carnegie Mellon University, Software Engineering Institute. (2018). Common Sense Guide to Mitigating Insider Threats (6th ed.). Practice 1: Know and Protect Your Critical Assets. Page 11. "The first step in protecting critical assets is to determine what they are and where they are located... Once you have identified and prioritized your critical assets, you can focus your resources on protecting them."

2. NIST Special Publication 800-53, Revision 5. (2020). Security and Privacy Controls for Information Systems and Organizations. Control: AC-5 Separation of Duties. Page 103. This control explicitly mandates dividing duties to prevent individuals from having excessive control, directly contradicting option E.

3. NIST Special Publication 800-50. (2003). Building an Information Technology Security Awareness and Training Program. Section 2.1, Page 4. "An effective security awareness and training program requires the support of all employees... It can help the organization to avoid monetary loss... and increase the accountability of all employees." This directly contradicts the claim in option B.

4. Harris, S., & Maymi, F. (2016). CISSP All-in-One Exam Guide (7th ed.). Chapter 5: Identity and Access Management. Page 261. "Job rotation is a detective control in that it may uncover fraudulent activities... It is also a preventative control because it lets employees know their actions will be reviewed." This contradicts option D.