GSEC Practice Questions

The defining characteristic and primary weakness of Electronic Codebook (ECB) mode is its deterministic nature. Each block of plaintext is encrypted independently of all other blocks using the same secret key. Consequently, if two plaintext blocks are identical, their corresponding ciphertext blocks will also be identical. This preserves plaintext patterns, allowing an attacker to infer information about the underlying data structure. In contrast, modes like Cipher Block Chaining (CBC), Cipher-Feedback (CFB), and Output-Feedback (OFB) use an Initialization Vector (IV) and a chaining or feedback mechanism. This ensures that the encryption of each block is dependent on the previous blocks, thus concealing patterns and making identical plaintext blocks result in different ciphertext blocks.

A. This describes a feature of chaining modes like CBC, where plaintext patterns are concealed, not a characteristic of ECB.

B. This accurately describes the benefit of modes like CBC, which is the direct opposite of how ECB functions.

D. This statement is contradictory. Randomizing the input to the block cipher is the very mechanism used to conceal plaintext patterns.

1. National Institute of Standards and Technology (NIST). (2001). Special Publication 800-38A: Recommendation for Block Cipher Modes of Operation. Section 6.1

"Electronic Codebook (ECB) Mode

" states

"The disadvantage of the ECB mode is that identical plaintext blocks are encrypted into identical ciphertext blocks; thus

it does not hide data patterns well."

2. Katz

J.

& Lindell

Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. In Chapter 3

Section 3.6.2

"Modes of Operation

" the text explains that for ECB

"if mi = mj

then ci = cj

" highlighting that this leaks information about the plaintext.

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2017). 6.857 Computer and Network Security

Fall 2017. Lecture 5 notes on Block Ciphers II illustrate this difference

stating for ECB: "Identical plaintext blocks give identical ciphertext blocks. This is BAD." The notes contrast this with CBC

which randomizes the encryption.

When using VMware in Network Address Translation (NAT) mode, the host system acts as the NAT device. The virtualization software on the host creates a private virtual network for the guest virtual machines. When a guest system needs to communicate with the external network, the host system intercepts the traffic, translates the guest's private source IP address to its own IP address, and forwards the packet. This allows the guest system to access external resources using the host's network identity, without requiring its own unique IP address on the external network.

A. Guest system: The guest system is the client of the NAT service; it originates the traffic but does not perform the address translation itself.

B. Local gateway: The local gateway is the physical router on the host's network, which is upstream and unaware of the virtual NAT process.

D. Virtual system: This term is ambiguous. While the NAT device is a virtual component, it is the host system's software that provides this functionality.

1. VMware Workstation Pro Documentation: In the section "Using Network Address Translation

" the official documentation states

"The NAT device operates on the host system... VMware Workstation NAT uses the host computer's IP address to send and receive virtual machine network traffic." This confirms the host system performs the NAT function. (Source: VMware Workstation 17 Pro Documentation

Chapter: Configuring Network Connections

Section: Using Network Address Translation).

2. Carnegie Mellon University

School of Computer Science: In lecture notes for course 15-440/640: Distributed Systems

the networking modes for virtualization are described. For NAT

it is stated: "The VM gets a private IP address

and the hypervisor acts as a NAT router to translate it to the host's IP address." The hypervisor runs on the host system. (Source: CMU

15-440/640

Lecture 2: Virtualization

Slide on "VM Networking").

3. University of Washington

Paul G. Allen School of Computer Science & Engineering: Course materials for CSE 481I explain VMware networking modes. For NAT mode

it specifies: "The host OS has a Network Address Translation (NAT) service that transparently routes traffic between the guest OS and the physical network." (Source: University of Washington

CSE 481I

"Introduction to VMware" documentation).

In Unix-like operating systems, permissions for directories are distinct from those for files. To "enter" or traverse a directory (e.g., using the cd command), a user requires the execute (x) permission. To "list its contents" (e.g., using the ls command), the user needs the read (r) permission. The question requires the minimum permission for both actions.

In octal notation, read is represented by 4, and execute is represented by 1. Therefore, the minimum required permission is the sum of these values: 4 (read) + 1 (execute) = 5. This permission level (r-x) allows a user to both enter the directory and view its contents.

1. Kerrisk

M. (2010). The Linux Programming Interface: A Linux and UNIX System Programming Handbook. No Starch Press. In Chapter 15

"File I/O (Further Details)"

Section 15.4 "Permissions on Directories" explains that read permission allows listing directory contents and execute permission (search permission) allows a process to pass through the directory. The octal values are detailed in Table 15-3.

2. Sobell

M. G. (2017). A Practical Guide to Linux Commands

Editors

and Shell Programming. Pearson Education. In Chapter 4

"The Filesystem"

the section "Access Permissions" includes Table 4-5

which explicitly states that for a directory

read permission allows listing contents (ls) and execute permission allows making it the working directory (cd).

3. MIT OpenCourseWare. (2012). 6.828 Operating System Engineering

Fall 2012. Massachusetts Institute of Technology. Lecture 8

"File systems"

discusses the semantics of Unix file permissions

noting that for directories

the execute bit allows path traversal

and the read bit allows listing the names of files within it.

The name resolution process on a Unix system first checks the local /etc/hosts file before querying a DNS server. The goal is to make the malware running on the infected computer (192.168.1.120) connect to the analysis computer (192.168.1.115). To achieve this, the hosts file on the infected machine must be modified. An entry must be added that maps the hostname the malware is trying to resolve (iamabadserver.com) to the IP address of the desired destination (192.168.1.115). This redirects the malware's network traffic to the controlled analysis machine, a common technique in dynamic malware analysis.

A. Modifying the hosts file on the destination computer has no effect on the name resolution process occurring on the source (infected) computer.

C. This entry modifies the correct file but redirects the malware to connect to itself (192.168.1.120), not the intended analysis computer.

D. The name resolution is performed by the client initiating the connection (the infected machine), not the machine it is intended to connect to.

1. Red Hat Enterprise Linux 8 Documentation

"Configuring host names"

Section 3.2

"Configuring static host names using the /etc/hosts file": This official documentation specifies that the /etc/hosts file is used to map hostnames to IP addresses on a local machine

particularly in the absence of a DNS server. It confirms the format IP-address canonical-hostname [aliases...] and its role in the name resolution process.

2. MIT OpenCourseWare

6.033 Computer System Engineering

Spring 2018

Recitation 10: Naming

Section 2

"Name Resolution": This university courseware explains the hierarchy of name resolution. It clarifies that a system will check local configuration files

such as /etc/hosts

for a mapping before attempting to contact an external DNS server. This principle is central to why modifying the local hosts file works.

3. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. (Referenced in numerous university curricula

e.g.

Carnegie Mellon University

Course 14-822): Chapter 16

"Malware-Focused Network Signatures

" and Chapter 19

"Analyzing Malicious Documents

" describe the technique of using the /etc/hosts file to redirect a malware's network communications to a local analysis machine to observe its behavior in a controlled environment.

In Unix-like operating systems, including Linux, environment variables store information about the shell session. The $SHELL environment variable specifically holds the path to the user's default login shell (e.g., /bin/bash, /bin/zsh). The echo command is a shell built-in that prints its arguments to the standard output. Therefore, executing echo $SHELL (or $shell, assuming a common typo in the question, as environment variables are case-sensitive and typically uppercase) retrieves the value of this variable and displays it on the screen, directly answering the user's question about which shell they are using.

A. mv $shell: This command is used to move or rename files. It would incorrectly attempt to move the shell's executable file.

C. rm $shell: This is the remove command. It would dangerously attempt to delete the shell's executable file, not display its name.

D. ls $shell: This command lists file attributes. It would show details about the shell executable file, not simply print its name as requested.

---

1. MIT OpenCourseWare. (2020). The Missing Semester of Your CS Education

Lecture 2: Shell Tools and Scripting. Massachusetts Institute of Technology. Retrieved from https://missing.csail.mit.edu/2020/shell-tools/. In the "Shell Variables" section

it states

"To see the value of a variable

you can use the echo command... For example

the $SHELL variable has the path of the shell program itself."

2. GNU Bash Reference Manual. (2022). 5.2 Bash Variables. Free Software Foundation. Retrieved from https://www.gnu.org/software/bash/manual/htmlnode/Bash-Variables.html. The documentation lists SHELL as a variable to which "Bash assigns... the full pathname of the current user’s login shell." The manual also documents echo as the standard command for displaying values.

3. Sobell

M. G. (2012). A Practical Guide to Linux Commands

Editors

and Shell Programming. Prentice Hall. In Chapter 4

"The Bourne Again Shell

" the text explains shell and environment variables

explicitly mentioning that echo $SHELL is used to display the user's login shell. (Specific reference: Chapter 4

Section: "Standard Shell Variables").

The Domain Name System (DNS) is the hierarchical and distributed naming system used to identify computers and resources reachable through the internet. Its primary function is to translate human-readable hostnames (e.g., www.sans.org) into the numerical IP addresses (e.g., 104.20.1.24) required by networking protocols to locate and route traffic to the correct destination. This resolution process is a fundamental operation for nearly all internet activity, including web browsing and email.

A. Computer Browser: This is a legacy Microsoft Windows service for discovering shared resources on a local network; it does not perform internet-scale hostname-to-IP resolution.

B. DHCP: The Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and other network configuration parameters to devices, but it does not resolve hostnames for clients.

D. WINS: Windows Internet Name Service (WINS) is a legacy Microsoft service that resolves NetBIOS names to IP addresses, primarily for older Windows networking environments, not standard internet hostnames.

1. Mockapetris

P. (1987). RFC 1035: Domain Names - Implementation and Specification. Internet Engineering Task Force (IETF). Section 1

"INTRODUCTION

" states

"The domain system is a distributed database. In this model the database is partitioned by name... The DNS provides for the mapping of domain names to addresses and other data." Available at: https://doi.org/10.17487/RFC1035

2. Kurose

J.

& Ross

K. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 2

Section 2.5

"The Internet's Directory Service: DNS

" explains

"The main function of DNS is to translate hostnames to IP addresses." This textbook is widely used in university computer science curricula.

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2018). 6.033 Computer System Engineering

Spring 2018. Lecture 17

"Naming

" describes DNS as the canonical system for mapping human-readable names to network addresses (IP addresses). The lecture notes detail this process as the primary purpose of the DNS protocol.

4. Microsoft Corporation. (2023). DNS overview. Microsoft Learn. The documentation states

"Domain Name System (DNS) is a distributed database that's used to translate a user-friendly domain name

such as www.microsoft.com

to a numerical IP address

such as 192.0.2.1."

PowerShell remoting is built upon the Windows Remote Management (WinRM) service. In a Windows Active Directory domain environment, WinRM defaults to using Kerberos for authentication. When a user on a domain-joined machine initiates a remote session to another, the client machine obtains a Kerberos service ticket from the domain controller's Key Distribution Center (KDC). This ticket is then presented to the target server to authenticate the user's identity securely without transmitting passwords or other secrets over the network. This is the standard mechanism for integrated Windows Authentication within a domain.

A. Two factor codes: This is a method for multi-factor authentication (MFA), not the underlying authentication protocol used by default for PowerShell remoting.

B. Unique application passwords: These are typically used as an alternative to user passwords for applications that do not support modern authentication methods, not for interactive remoting.

C. PreShared keys: These are symmetric keys used in protocols like IPsec or WPA for authentication and are not the default mechanism for PowerShell remoting in a domain.

---

1. Microsoft Corporation. (2023

September 15). About Remote Requirements. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/aboutremoterequirements.

Under the "User permissions" section

it states

"By default

PowerShell remoting uses Kerberos to authenticate users and to encrypt data."

2. Microsoft Corporation. (2023

September 21). Installation and configuration for Windows Remote Management. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management.

In the "Authentication for remote connections" section

the documentation specifies

"In a domain

WinRM uses Kerberos for authentication. If the client is in a domain

but the remote computer is not

then you must add the remote computer to the client's list of trusted hosts."

3. Massachusetts Institute of Technology (MIT). (2011). 6.857 Computer and Network Security

Lecture 15: Kerberos. MIT OpenCourseWare. Retrieved from https://ocw.mit.edu/courses/6-857-computer-and-network-security-fall-2011/resources/mit6857f11lec15/.

This resource provides the foundational principles of the Kerberos protocol (Section: "Kerberos v5")

which is the technology leveraged by services like WinRM/PowerShell for authentication in a trusted domain environment.

The nbtstat (NetBIOS over TCP/IP Statistics) command is a diagnostic tool for NetBIOS over TCP/IP. It is used to troubleshoot NetBIOS name resolution problems. The -n switch specifically displays the local NetBIOS name table registered by the local computer. This table includes the computer's unique NetBIOS name (type ) and the workgroup or domain name (type ), making it the direct command to view the local machine's NetBIOS name.

A. NETSTAT -s: This command displays detailed per-protocol statistics for TCP, UDP, ICMP, and IP, not NetBIOS names.

B. NBTSTAT -s: This command displays the NetBIOS session table with the destination IP addresses, not the local name table.

D. NETSTAT -n: This command displays active TCP connections and ports in numerical form, bypassing name resolution entirely.

1. Microsoft Corporation. (2023). nbtstat. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nbtstat.

Reference Detail: Under the "Parameters" section

the documentation states that the -n parameter "Displays the local NetBIOS name table. In the table

each name is followed by its type and status (registered or conflict)."

2. Microsoft Corporation. (2023). netstat. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat.

Reference Detail: The "Parameters" section describes -s as "Displays per-protocol statistics" and -n as "Displays active TCP connections

however

addresses and port numbers are expressed numerically and no attempt is made to determine names."

3. University of Washington. (n.d.). Commonly Used Command Line Commands. UW-IT Connect. Retrieved from https://itconnect.uw.edu/learn/workshops/online-tutorials/command-line-interface/common-commands/.

Reference Detail: In the section on networking commands

nbtstat -n is described as the command to "display the local NetBIOS name table."

The scenario describes a Type II error, where an unauthorized individual was incorrectly authenticated by the biometric system. This is known as a False Accept. To mitigate this specific vulnerability, the system's matching threshold must be made more stringent. Lowering the False Accept Rate (FAR) directly addresses this by reducing the probability that an imposter is accepted as a legitimate user. This adjustment makes the system more secure against unauthorized access, although it may consequently increase the False Reject Rate (FRR), potentially inconveniencing valid users.

A. Try raising the Crossover Error Rate (CER): Raising the CER indicates a less accurate system overall, which is counterproductive to enhancing security.

C. Try setting the Equal Error Rate (EER) to zero: The EER (or CER) is a point where FAR equals FRR. Setting it to zero implies a perfect, error-free system, which is practically unattainable.

D. Try to set a lower False Reject Rate (FRR): Lowering the FRR makes the system more lenient and increases the likelihood of a false acceptance, exacerbating the problem described.

---

1. Jain

A. K.

Ross

A.

& Prabhakar

S. (2004). An introduction to biometric recognition. IEEE Transactions on Circuits and Systems for Video Technology

14(1)

4-20. In Section III.A

"Biometric System Errors

" the paper defines the False Acceptance Rate (FAR) as "the probability that the system incorrectly declares a successful match between the input pattern and a nonmatching template in the database" (p. 8). The scenario is a direct example of this error. DOI: https://doi.org/10.1109/TCSVT.2003.818349

2. National Institute of Standards and Technology (NIST). (2011). NIST Special Publication 800-76-2: Biometric Data Specification for Personal Identity Verification. In Section 1.5

"Conformance

" the document defines False Accept Rate (FAR) and False Reject Rate (FRR) as key performance metrics. The trade-off is explained

where decreasing one (e.g.

FAR for higher security) typically increases the other.

3. Woodward

J. D.

Orlans

N. M.

& Higgins

P. T. (2003). Biometrics. McGraw-Hill/Osborne. In Chapter 3

"Leading Biometric Technologies

" the relationship between FAR and FRR is detailed

explaining that system administrators must tune the sensitivity threshold to balance security (low FAR) and convenience (low FRR). The scenario requires prioritizing security by lowering the FAR.

4. Grother

P.

& Ngan

M. (2014). NIST Interagency Report 8004: Face Recognition Vendor Test (FRVT) Performance of Face Recognition Algorithms. Section 2.1

"Error Rates

" defines the False Match Rate (FMR)

equivalent to FAR

and the False Non-Match Rate (FNMR)

equivalent to FRR

as fundamental error metrics for biometric systems. It discusses how thresholds are set to achieve a desired low FMR for high-security applications.

The scenario describes a classic buffer overflow vulnerability. The application allocates a fixed-size memory buffer (10 characters) but fails to perform bounds checking on the user-supplied input. When a user enters more data than the buffer can hold, the excess data overwrites adjacent memory locations. This can lead to program instability, crashes, or the execution of malicious code if an attacker carefully crafts the input. The core issue is the lack of input length validation against the allocated memory space.

A. Session hijacking: This attack involves stealing a user's valid session identifier to gain unauthorized access, which is unrelated to input length validation.

C. Cross-site scripting: This is an injection attack where malicious scripts are injected into trusted websites, stemming from a failure to validate input content, not its length.

D. SQL Injection: This attack involves inserting malicious SQL statements into an entry field for execution, resulting from a failure to sanitize input for database query characters.

1. National Institute of Standards and Technology (NIST)

"Common Weakness Enumeration (CWE-120): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

" CWE Version 4.6. This official standard defines the vulnerability as occurring when data is copied into a buffer without verifying that the input will fit

which is precisely the scenario described.

2. Pfleeger

C. P.

& Pfleeger

S. L. (2006). Security in Computing (4th ed.). Prentice Hall. In Chapter 3

"Program Security

" Section 3.2

"Nonmalicious Program Errors

" the text explicitly details buffer overflows as a primary example of programming flaws where "a program does not check the amount of data to be copied into a buffer of a certain size" (p. 115).

3. Erickson

J. (2008). Hacking: The Art of Exploitation (2nd ed.). No Starch Press. Chapter 3

"Exploitation

" provides a detailed technical breakdown of how buffer overflows work

starting with the fundamental premise of writing more data into a buffer than was originally allocated (pp. 85-90). This is considered a foundational text in many university security courses.

4. MIT OpenCourseWare. 6.858 Computer Systems Security

Fall 2014. Lecture 3

"Controlling Untrusted Code

" discusses buffer overflows as a primary method for attackers to seize control of a program by providing an overly long input string that overwrites the return address on the stack.