Application and User Monitoring Analytics GCDA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A long-tenured employee in the finance department suddenly accesses the HR database for the first time, downloads a large number of employee records, and then attempts to send them to a personal email address. The user's baseline shows no prior access to HR systems or personal email usage. What is the most appropriate immediate response?

   • ASend a warning email to the user and require them to acknowledge the policy violation.
   • BBlock the personal email domain at the email gateway and continue monitoring the user's activity.
   • CQuarantine the user's session, preserve the relevant logs, and escalate to the incident response team for a formal investigation.
   • DSuspend the user's account and initiate an insider threat investigation.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat hunting team wants to proactively identify compromised accounts that are using legitimate remote access tools to move laterally. They have user login logs and application execution logs. What is the most effective hunting approach?

   • ASearch for any use of remote access tools, regardless of the user or time.
   • BFocus only on failed login attempts to identify brute force attacks.
   • CBuild a baseline of normal remote access tool usage per user and then hunt for deviations.
   • DDisable remote access tools to prevent lateral movement.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to centralize monitoring of user logins and application usage to detect anomalies. They currently have separate logs for authentication and application events. What is the most effective way to enable centralized analysis and alerting?

   • AForward both authentication and application logs to the SIEM and create correlation rules.
   • BOnly forward authentication logs to the SIEM and ignore application logs.
   • CStore the logs in a shared folder and have analysts manually review them.
   • DUse a separate monitoring tool for each log source and compare alerts manually.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What type of user activity anomaly might indicate data exfiltration?

   • AA user attending a scheduled meeting
   • BA user changing their desktop wallpaper
   • CA user printing a document to a local printer
   • DA user downloading a large volume of data from a file server they rarely access
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to centralize monitoring of user logins and application errors. They have a SIEM platform that receives logs from multiple sources. Which integration approach best enables the SIEM to correlate user activity with application anomalies?

   • AStore logs only in the application's local log files
   • BForward authentication logs and application error logs to the SIEM with a common user identifier
   • CUse separate SIEMs for user and application logs
   • DSend logs to the SIEM without any parsing or normalization
   Reveal Solution Discussion Select an answer first