Application and User Monitoring Analytics GCDA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A financial services firm's web application logs show a sudden increase in HTTP 500 errors from a single user's session, followed by a successful login as an administrator from the same IP address minutes later. The application's baseline shows this user typically accesses only the customer portal and never triggers server errors. Which action best balances immediate response with preserving forensic evidence?

   • APreserve the application and authentication logs, then temporarily restrict the user's privileges while investigating the anomaly.
   • BDisable the user's account and block the IP address at the firewall immediately.
   • CReset the user's password and force a re-authentication, then continue monitoring the session.
   • DIsolate the affected application server and take a memory snapshot before further analysis.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What type of anomaly in application logs could indicate privilege escalation?

   • AA user accessing the application during business hours
   • BA user account performing administrative actions without prior admin activity
   • CAn application logging normal startup messages
   • DAn application sending routine heartbeat messages
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A user in the accounting department typically logs in from 8:00–17:00 local time, accesses the ERP system, and downloads fewer than 10 PDFs per day. Over the past week, the user logged in at 02:00–03:00 from a foreign IP, accessed the ERP, and downloaded 200 PDFs each night. The user's credentials were not changed. Which user behavior baseline deviation is the strongest indicator of account compromise?

   • AThe use of the ERP system
   • BThe increased number of PDF downloads
   • CThe foreign IP address and unusual login time
   • DThe lack of credential changes
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A web application's logs show a series of requests with a parameter that contains a long string of SQL commands. The application normally receives short, numeric parameters for that field. Which anomaly in the application logs is most indicative of an attack?

   • AThe requests are spread over several minutes
   • BThe application returns HTTP 200 responses
   • CThe requests come from a single IP address
   • DThe parameter contains SQL commands instead of the expected numeric format
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which application-related indicator is a strong sign of compromise?

   • AAn application spawning a command shell (e.g., cmd.exe) unexpectedly
   • BAn application connecting to a known update server
   • CAn application using a consistent amount of memory over time
   • DAn application writing to its own log file
   Reveal Solution Discussion Select an answer first