Application and User Monitoring Analytics GCDA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary goal of leveraging analytics for threat hunting?

   • ATo generate weekly reports for management
   • BTo automate the response to all security alerts
   • CTo proactively search for threats that evade traditional detection
   • DTo replace the need for security information and event management (SIEM) tools
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A user's account shows a login from a foreign IP at 2:00 AM, followed by a large data download. The user is a senior executive who frequently travels and sometimes logs in from foreign IPs at odd hours. The executive's assistant confirms the executive is on a business trip. Which response action is most appropriate?

   • AVerify the login with the executive via a secondary channel, then decide whether to suspend
   • BIgnore the alert because the executive travels frequently
   • CChange the executive's password without verification
   • DImmediately suspend the account
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A user who normally accesses the HR system only during business hours and only from the office suddenly logs in from a coffee shop IP at 11:00 PM and views the salary table. Which user behavior indicator most strongly suggests the account is compromised?

   • AThe user is using a coffee shop IP
   • BThe user is viewing the salary table
   • CThe login from a coffee shop IP at 11:00 PM, which is outside the user's normal access pattern
   • DThe user is accessing the HR system
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A web application's logs show a sudden spike in HTTP 500 errors, and the error messages contain SQL syntax fragments. The application is business-critical and must remain available. Which response action best balances containment with business continuity?

   • ADisable the database account used by the application
   • BIgnore the errors because they are only HTTP 500s
   • CShut down the web server immediately
   • DPlace the web application firewall in block mode for SQL injection signatures
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What does an application indicator of compromise (IOC) typically represent?

   • AA specific artifact or behavior that suggests the application or system is compromised
   • BA user preference that customizes the application interface
   • CA configuration setting that improves application performance
   • DA feature that allows the application to update automatically
   Reveal Solution Discussion Select an answer first