Application and User Monitoring Analytics GCDA Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A company wants to create user behavior baselines to detect compromised accounts. They have historical data for all users, including login times, access patterns, and data transfer volumes. However, some users have very little historical data because they are new employees or have changed roles. What is the most effective approach to handle these users?

   • ACreate a baseline based on the user's job role and department, and update it as more data becomes available.
   • BUse the company-wide average behavior as the baseline for users with insufficient data.
   • CDo not monitor users with insufficient data until they have enough history.
   • DUse the most restrictive baseline (e.g., no off-hours access) for all users with insufficient data.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A critical business application is showing signs of a SQL injection attack. The application cannot be taken offline, but the attack must be contained. The security team has a WAF that can block specific signatures, but the application also uses legitimate dynamic queries that may match some signatures. Which response action best balances containment with business continuity?

   • AEnable WAF in block mode for the specific SQL injection signatures that match the observed attack
   • BEnable WAF in detection mode only
   • CDisable the database connection pool
   • DBlock all traffic to the application
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is proactively hunting for threats that evade traditional detection. The analyst notices that a legitimate PDF viewer application, which normally opens files from the user's Documents folder, has recently been spawning PowerShell processes. Which hunting technique would best identify this as a potential indicator of compromise?

   • ABaseline the application's normal process tree and alert on child processes like PowerShell
   • BReview the firewall logs for outbound connections
   • CCheck the user's browser history
   • DSearch for all PDF files on the system
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team wants to proactively hunt for a sophisticated attacker who is using legitimate applications to exfiltrate data. The attacker is likely to use a common cloud storage sync client. The team has SIEM data from endpoint logs and application logs. Which hunting approach is most likely to uncover the attacker?

   • ABlock the sync client application entirely
   • BBaseline the normal upload volume and frequency of the sync client per user, then hunt for deviations in the SIEM
   • CLook for the attacker's known IP addresses
   • DSearch for the sync client's process name in all logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An application's logs show a pattern of repeated attempts to access a configuration file that is not normally accessed. The attempts are coming from a single user account that has never accessed this file before. The application is critical to business operations and cannot be taken offline. What is the best response?

   • AIgnore the attempts because the user may have a legitimate reason.
   • BReset the user's password and require multi-factor authentication.
   • CBlock the user's access to the configuration file and alert the security team.
   • DTake the application offline immediately to prevent further access.
   Reveal Solution Discussion Select an answer first