What is the primary importance of user monitoring in security analytics?

It tracks employee productivity for performance reviews

It helps identify insider threats and compromised accounts by tracking user activity

It ensures users follow company social media policies

It replaces the need for endpoint detection and response tools

A user who typically works 9-to-5 from the office suddenly logs in at 2:00 AM from a VPN endpoint that is normally used by the IT department. The user then attempts to access a database that is not part of their job function. The SIEM shows no other anomalies. What is the most appropriate response?

Flag the session for investigation, temporarily restrict access to the database, and alert the incident response team.

Immediately disable the user's account and reset all their passwords.

Ignore the anomaly because it is a single event and the user may have a legitimate reason.

Contact the user to verify the activity before taking any action.

What is the primary goal of creating baseline profiles of user activity?

To enforce password complexity requirements

To detect deviations that may signal security incidents

To evaluate employee performance for promotions

To automate user account provisioning

Which type of data is most commonly analyzed in application monitoring to detect malicious activity?

Application logs, process execution details, and system calls

User login timestamps and failed authentication attempts

Network firewall logs and intrusion prevention alerts

Employee performance metrics and productivity reports

What type of user behavior might indicate an insider threat?

A user accessing sensitive data outside of their normal job function

A user attending a mandatory training session

A user taking a scheduled vacation day

A user requesting a new keyboard from IT

GIAC Certified Detection Analyst

Domain 4Objective 2

Application and User Monitoring Analytics GCDA Practice Questions (Page 11)

Part of the Endpoint and User Analytics domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 51–55

51foundation · easy
What is the primary importance of user monitoring in security analytics?
Select an answer first
52application · medium
A user who typically works 9-to-5 from the office suddenly logs in at 2:00 AM from a VPN endpoint that is normally used by the IT department. The user then attempts to access a database that is not part of their job function. The SIEM shows no other anomalies. What is the most appropriate response?
Select an answer first
53foundation · easy
What is the primary goal of creating baseline profiles of user activity?
Select an answer first
54foundation · easy
Which type of data is most commonly analyzed in application monitoring to detect malicious activity?
Select an answer first
55foundation · easy
What type of user behavior might indicate an insider threat?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.