Application and User Monitoring Analytics GCDA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of application monitoring in the context of endpoint and user analytics?

   • ATo replace traditional antivirus solutions with real-time application scanning
   • BTo track application usage for license compliance and cost optimization
   • CTo detect malicious activity by observing application behavior and resource usage
   • DTo enforce application whitelisting policies across the enterprise
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of establishing a baseline for application behavior?

   • ATo replace the need for signature-based detection
   • BTo identify anomalies that may indicate compromise or misuse
   • CTo enforce application usage policies
   • DTo optimize application performance
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which scenario best illustrates the value of user monitoring in detecting a compromised account?

   • AA user receives a phishing email but does not click the link
   • BA user changes their password after forgetting it
   • CA user accesses a shared network drive during business hours
   • DA user logs in from a new device and downloads a large amount of sensitive data
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A company has a SIEM that receives authentication logs and application logs. An analyst notices that a user's account was used to log in from a new location, and within the same hour, the user's account was used to access a sensitive database and then to send a large amount of data to an external IP. The user is a senior executive who frequently travels and sometimes accesses the database from unusual locations. The SIEM has no baseline for this user's travel patterns. What is the most appropriate response?

   • AIncrease the SIEM alert threshold to reduce false positives for this user.
   • BImmediately suspend the user's account and block the external IP address.
   • CIgnore the activity because the user is a senior executive and likely has legitimate reasons.
   • DCorrelate the login location with the user's travel itinerary and the database access with the user's job responsibilities before taking action.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst notices that a marketing employee's account logs in at 3:00 AM from a foreign IP, and simultaneously the company's file-sharing application shows a bulk download of sensitive customer data. The SIEM has separate alerts for off-hours logins and large downloads, but neither triggered a critical alert. What is the most effective way to detect this type of coordinated activity in the future?

   • ABlock all foreign IP addresses at the perimeter firewall to prevent such logins.
   • BDisable the user's account and require manager approval for any future off-hours access.
   • CCreate a correlation rule in the SIEM that links authentication events with file-access events from the same user within a short time window.
   • DIncrease the sensitivity of the existing off-hours login alert so it triggers on any login outside business hours.
   Reveal Solution Discussion Select an answer first