GIAC Security Operations Certified - GSOC Exam Questions [2026]

QUESTION NO: 1
What role does DHCP play in network communications, and why is it a target for attackers?
Response:

A. It encrypts network traffic, attracting attackers who wish to decrypt it. B. It assigns IP addresses to hosts, making it a target for spoofing and poisoning attacks. C. It serves web content, which can be manipulated. D. It relays email messages, which can be intercepted.

Correct Answer: B

QUESTION NO: 2
Which of the following is a common type of attack against HTTPS traffic?
Response:

A. Distributed Denial of Service (DDoS) B. SSL Strip Attack C. Brute-force password attack D. SQL Injection

Correct Answer: B

QUESTION NO: 3
Which method is effective in identifying data exfiltration over the network?
Response:

A. Detecting unusual spikes in outbound traffic volume B. Monitoring for consistent data transfer rates only during business hours C. Focusing solely on inbound traffic D. Ignoring encrypted traffic as it cannot be inspected

Correct Answer: A

QUESTION NO: 4
Which file in Linux contains information about previous boot messages?
Response:

A. /var/log/boot.log B. /etc/fstab C. /boot/grub/grub.cfg D. /var/log/cron

Correct Answer: A

QUESTION NO: 5
During the sharing phase of analytics, what is an effective practice for fostering understanding and engagement among stakeholders?
(Choose Three)
Response:

A. Tailoring the presentation to the audience's level of expertise B. Providing detailed technical documentation to all stakeholders regardless of their background C. Utilizing interactive visualizations D. Offering actionable insights based on the data E. Limiting access to data to prevent information overload

Correct Answer: A,C,D

QUESTION NO: 6
What is a key benefit of having centralized logging of endpoint events?
Response:

A. Centralized logs prevent endpoints from logging any information, reducing their workload. B. It ensures that logs are only accessible locally on each endpoint. C. Centralized logging can help in correlating events and detecting anomalies. D. It allows for easier erasure of logs to free up disk space.

Correct Answer: C

QUESTION NO: 7
What are the primary security measures to protect against SMB relay attacks?
(Choose Two)
Response:

A. Enabling SMB signing B. Using FTP instead of SMB C. Blocking all outbound SMB traffic D. Disabling SMBv1

Correct Answer: A,D

QUESTION NO: 8
What is the purpose of DNSSEC in securing the DNS protocol?
Response:

A. To encrypt all DNS traffic B. To authenticate DNS responses and protect against DNS spoofing C. To reduce DNS query times D. To block all DNS requests from external sources

Correct Answer: B