Application and User Monitoring Analytics GCDA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A company has a SIEM that receives logs from multiple applications and authentication systems. The security team wants to detect attacks that span multiple systems, such as a user logging in and then exploiting an application. Which SIEM configuration is most effective?

   • AStore logs in their raw format without normalization
   • BCreate separate alerts for each log source
   • CNormalize logs from all sources and create correlation rules that link user and application events
   • DOnly forward logs from the most critical application
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A user who normally works from the office suddenly logs in from a foreign country at 3:00 AM and attempts to transfer a large sum to an external bank account. The user's manager confirms the user is on vacation and not traveling. Which response action is most appropriate?

   • AAllow the transfer because the user's credentials were used
   • BChange the user's password and do nothing else
   • CContact the user by email to ask if they are traveling
   • DTemporarily suspend the user's account and escalate to the incident response team
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An analyst notices that a web application's logs show repeated SQL injection attempts from a single IP address, and shortly after, the application's error logs show a new user account created with administrative privileges. The application's baseline shows no such account creation activity. What is the most likely conclusion?

   • AThe new account was created by a legitimate administrator during routine maintenance.
   • BThe logs are corrupted and the alerts are false positives.
   • CThe application is experiencing a denial-of-service attack.
   • DThe application has a vulnerability that was exploited to achieve privilege escalation.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A file transfer application normally uploads files of 1–5 MB to a known partner server. Over the past hour, the application uploaded a 500 MB archive to an IP address not on the partner list. Which application-related indicator of compromise is most evident?

   • AThe application is running at all
   • BUnusual outbound data volume to an unknown destination
   • CThe upload occurred during business hours
   • DThe file size is 500 MB
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which response action is most appropriate when an application anomaly is detected but the application is critical to business operations?

   • ARestart the application server immediately
   • BIsolate the affected application instance while keeping other instances running
   • CDisable the application for all users until the issue is resolved
   • DDelete the application logs to prevent further analysis
   Reveal Solution Discussion Select an answer first