Application and User Monitoring Analytics GCDA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When user monitoring detects a potential compromised account, what is a common first response action?

   • ASend an email to the user asking if they are active
   • BChange the user's password without notifying them
   • CIgnore the anomaly if the user is a senior executive
   • DSuspend the account to prevent further malicious activity
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A user's account shows a login from a new device, followed by a change to the account's email address and a request to reset the password. The user is currently on vacation and has not responded to phone calls. What is the most appropriate response?

   • ALeave the account active and monitor for further activity.
   • BSuspend the account and initiate a password reset process through the help desk.
   • CSend an email to the user's new email address to verify the change.
   • DTemporarily disable the account and escalate to the incident response team for investigation.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A company has a SIEM that receives logs from multiple sources, including authentication, application, and network devices. The security team wants to detect a coordinated attack where an attacker compromises a user account and then uses it to access a sensitive application and exfiltrate data. The SIEM currently has separate alerts for each log source but no correlation rules. What is the most effective way to detect this attack?

   • AIncrease the sensitivity of the authentication alert to catch any login from a new device.
   • BCreate a correlation rule that links authentication events with application access events and network egress events from the same user within a short time window.
   • CUse a separate SIEM for each log source to avoid overwhelming the main SIEM.
   • DManually review the logs from each source on a daily basis.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which data source is most commonly used to build a user behavior baseline?

   • ANetwork firewall configuration files
   • BHardware inventory lists
   • CApplication source code repositories
   • DAuthentication logs and access logs
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is concerned about insider threats. They want to monitor user behavior to detect employees who might be exfiltrating data. Which user monitoring approach is most effective for identifying insider threats?

   • AMonitor all user activity without any baseline
   • BReview user activity only after an incident occurs
   • CBaseline each user's normal activity and alert on deviations such as large data transfers or unusual access times
   • DOnly monitor users in high-risk departments
   Reveal Solution Discussion Select an answer first