An employee in marketing typically accesses the CRM system from 9:00–17:00 and exports customer lists once a month. Over the past three days, the employee has exported the entire customer database every hour. Which user activity anomaly is most indicative of malicious activity?

The frequency and volume of data exports

The employee uses the CRM system

The exports occur during business hours

The employee is in the marketing department

A security team is establishing a baseline for a custom business application that processes financial transactions. The application logs show that the number of transactions per hour varies significantly depending on the time of day and day of the week. The team wants to detect anomalies that could indicate fraud or compromise. What is the most effective baselining approach?

Use a simple average of transactions per hour as the baseline and alert on any deviation.

Disable anomaly detection for this application because the volume is too variable.

Create separate baselines for different time periods (e.g., business hours, weekends, holidays) and alert on deviations from the relevant baseline.

Use the maximum transaction volume ever observed as the baseline and alert on any volume above that.

A company runs a custom web application. The security team wants to detect malicious activity such as injection attacks. Which application monitoring practice would be most effective?

Log all application requests and responses, including error messages and query parameters

Log only user authentication events

A security team wants to detect a new malware variant that uses a legitimate system tool (e.g., PowerShell) to run encoded commands. The team has application logs that show process execution, but they do not have a baseline for normal PowerShell usage. What is the best first step to enable detection?

Disable PowerShell on all endpoints to prevent the malware from running.

Immediately hunt for encoded commands in the existing logs without a baseline.

Create a rule that alerts on any PowerShell execution, since it is rarely used in the environment.

Collect PowerShell execution logs for a period of time to establish a baseline of normal usage patterns.

A SIEM alert shows that a user logged in successfully, then immediately triggered an application error that reveals a stack trace with a command injection payload. The user has no history of using that application. Which correlation best describes the attack scenario?

The application is malfunctioning due to a software bug

The user is performing a legitimate administrative task

The user account is compromised and is being used to exploit the application

The SIEM is generating a false positive

GIAC Certified Detection Analyst

Domain 4Objective 2

Application and User Monitoring Analytics GCDA Practice Questions (Page 6)

Part of the Endpoint and User Analytics domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 26–30

26application · medium
An employee in marketing typically accesses the CRM system from 9:00–17:00 and exports customer lists once a month. Over the past three days, the employee has exported the entire customer database every hour. Which user activity anomaly is most indicative of malicious activity?
Select an answer first
27expert · medium
A security team is establishing a baseline for a custom business application that processes financial transactions. The application logs show that the number of transactions per hour varies significantly depending on the time of day and day of the week. The team wants to detect anomalies that could indicate fraud or compromise. What is the most effective baselining approach?
Select an answer first
28application · medium
A company runs a custom web application. The security team wants to detect malicious activity such as injection attacks. Which application monitoring practice would be most effective?
Select an answer first
29application · medium
A security team wants to detect a new malware variant that uses a legitimate system tool (e.g., PowerShell) to run encoded commands. The team has application logs that show process execution, but they do not have a baseline for normal PowerShell usage. What is the best first step to enable detection?
Select an answer first
30application · medium
A SIEM alert shows that a user logged in successfully, then immediately triggered an application error that reveals a stack trace with a command injection payload. The user has no history of using that application. Which correlation best describes the attack scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Application and User Monitoring Analytics GCDA Practice Questions (Page 6)

Questions 26–30

An employee in marketing typically accesses the CRM system from 9:00–17:00 and exports customer lists once a month. Over the past three days, the employee has exported the entire customer database every hour. Which user activity anomaly is most indicative of malicious activity?

A company runs a custom web application. The security team wants to detect malicious activity such as injection attacks. Which application monitoring practice would be most effective?

A SIEM alert shows that a user logged in successfully, then immediately triggered an application error that reveals a stack trace with a command injection payload. The user has no history of using that application. Which correlation best describes the attack scenario?

Keep studying — Endpoint and User Analytics