Free GSNA Practice Questions

Question 1

During a web application audit, the development team states that user passwords are protected in the database using AES-256 encryption, with the key held in the application's configuration file. The auditor should conclude that:

Accepted Answer

This is a finding, because passwords must be hashed rather than encrypted

Answer

The control is adequate, as AES-256 is an approved strong algorithm

Answer

The control is adequate if the configuration file is restricted to the service account

Answer

This is a finding, because AES-256 should be replaced with SHA-256 encryption

Question 2

An auditor confirms that a web application is vulnerable to SQL injection. Which remediation should the auditor recommend as the PRIMARY control?

Accepted Answer

Parameterized queries

Answer

Server-side input validation rejecting known SQL metacharacters and keywords

Answer

Escaping all single quotes and special characters before the query string is built

Answer

Restricting the application's database account to least privilege

Question 3

An Nmap scan of a host returns port 445/tcp as "closed". What can the auditor legitimately conclude?

Accepted Answer

The host responded, and no application is listening on that port

Answer

A firewall or packet filter is dropping traffic destined for that port

Answer

The port is listening but protected by host-based access control restrictions

Answer

Nmap could not determine the port state, so the result is inconclusive

Question 4

A Group Policy Object linked at the domain level is configured as Enforced. An Organizational Unit beneath that domain has Block Inheritance enabled. What is the result for computers in that OU?

Accepted Answer

The domain GPO applies, because Enforced overrides Block Inheritance

Answer

Block Inheritance on the OU prevents the domain GPO from applying

Answer

Neither applies, and the local computer policy takes precedence by default

Answer

The settings conflict, so the GPO with the lower link order number prevails

Question 5

While auditing a Linux server, an auditor runs `ls -l` and observes:

-rwsr-xr-x 1 root root 47280 Mar 3 09:14 /usr/local/bin/logcollect

What is the PRIMARY audit concern?

Accepted Answer

Any user who executes this binary runs it with root privileges

Answer

The binary is world-readable and may disclose sensitive collection logic

Answer

The binary is owned by root, which violates the principle of least privilege

Answer

The binary lacks group-write permission, blocking administrator maintenance

Question 6

An asset is valued at $400,000. A ransomware event is estimated to destroy 25% of its value and is expected to occur once every five years. A proposed control costing $18,000 annually would eliminate the risk. What should the auditor report?

Accepted Answer

The control is justified, because the ALE of $20,000 exceeds the annual cost

Answer

The control is justified, because the ALE of $100,000 exceeds the annual cost

Answer

The control is not justified, because the ALE of $5,000 is below the annual cost

Answer

The control is not justified, because the $100,000 SLE occurs only once in five years

Question 7

An auditor reviewing a Windows Security log observes Event ID 4624 with Logon Type 10, originating from an external IP address at 02:47 local time. What does this record indicate?

Accepted Answer

A successful RemoteInteractive logon, such as an RDP session

Answer

A failed authentication attempt originating from a remote host

Answer

A successful network logon, such as a mapped file share connection

Answer

A successful service logon initiated automatically by the operating system

Question 8

Under the Time-Based Security model, a system has a Protection time of 12 minutes, a Detection time of 9 minutes, and a Response time of 7 minutes. What is the auditor's correct conclusion?

Accepted Answer

The system is exposed for 4 minutes, and reducing Detection time would improve it

Answer

The system is secured, since Protection exceeds Detection and Response individually

Answer

The system is exposed for 16 minutes, and only more Protection time can close the gap

Answer

The model cannot be applied without knowing asset value and threat likelihood

Question 9

An auditor reviews /etc/passwd on a production server and finds:

svc-backup:x:0:0:Backup Service:/home/svc-backup:/bin/bash

What should the auditor report?

Accepted Answer

The account has root-equivalent privileges, because its UID is 0

Answer

An interactive shell is assigned, which is inappropriate for a service account

Answer

The password hash is stored in /etc/passwd rather than in /etc/shadow

Answer

The account has no dedicated group, since its GID is identical to its UID

Question 10

A user is a member of the Finance group, which has Allow Modify on a folder, and the Contractors group, which has Deny Write on the same folder. The user's effective permission is:

Accepted Answer

Read and Execute, with Write denied

Answer

Modify, because explicit Allow permissions accumulate across group memberships

Answer

Modify, because the Finance grant is more specific than the Contractors group

Answer

No access, because a Deny on any permission removes all access to the object

Free GSNA Practice Questions

Domain 1: Auditing Access Control and Data Handling in Web Applications

Question 1

Domain 2: Auditing the Enterprise Network

Question 2

Domain 3: Auditing UNIX and Linux Systems

Question 3

Domain 4: Auditing Web Applications

Question 4

Question 5

Domain 5: Auditing Windows Systems and Domains

Question 6

Domain 6: Risk Assessment for Auditors

Question 7

Question 8

Domain 8: UNIX and Linux Logging and Continuous Monitoring

Question 9

Domain 9: Windows Logging and Continuous Monitoring

Question 10

The rest of the GSNA blueprint

That's 10 of 1,052