Which of the following is typically included in an application behavior baseline?

User passwords and authentication tokens

The organization's security policies and procedures

Normal network connections and file access patterns

The application's source code and version history

What is the appropriate escalation path when user monitoring detects a high-risk anomaly, such as a user downloading sensitive data at an unusual hour?

Send a warning email to the user and close the case

Escalate to the incident response team for further investigation

Ignore the anomaly if the user has a valid security clearance

Wait for the user to finish the download before taking action

How does application and user monitoring data typically feed into a SIEM?

By manually copying log files to the SIEM server

Through direct database connections to the application's database

Through log forwarding using protocols like Syslog or APIs

By having the SIEM scan the application's source code

When application monitoring detects a suspicious anomaly, what is the first priority in determining the response?

Notify all users to stop using the application

Contain the threat while minimizing disruption to business operations

Ignore the anomaly if it does not affect critical systems

Immediately shut down the entire application server

What is the primary benefit of correlating application and user monitoring data?

It automatically patches vulnerabilities in applications

It helps uncover coordinated attacks that span both user and application layers

It eliminates the need for endpoint detection and response tools

It reduces the volume of logs that need to be stored

GIAC Certified Detection Analyst

Domain 4Objective 2

Application and User Monitoring Analytics GCDA Practice Questions (Page 1)

Part of the Endpoint and User Analytics domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 1–5

1foundation · easy
Which of the following is typically included in an application behavior baseline?
Select an answer first
2foundation · easy
What is the appropriate escalation path when user monitoring detects a high-risk anomaly, such as a user downloading sensitive data at an unusual hour?
Select an answer first
3foundation · easy
How does application and user monitoring data typically feed into a SIEM?
Select an answer first
4foundation · easy
When application monitoring detects a suspicious anomaly, what is the first priority in determining the response?
Select an answer first
5foundation · easy
What is the primary benefit of correlating application and user monitoring data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.