Application and User Monitoring Analytics GCDA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A user in the finance department normally accesses the accounting system from 9:00–17:00 and processes 50–100 transactions per day. Over the past week, the user has been logging in at 18:00–20:00 and processing 200–300 transactions per day. The user's manager says the user is working overtime on a project. Which action is most appropriate?

   • AChange the user's password
   • BInvestigate the increased volume and after-hours access to determine if it is legitimate
   • CImmediately suspend the user's account
   • DIgnore the anomaly because the manager confirmed the overtime
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company's custom application has a known bug that causes it to crash when processing certain input. The security team wants to distinguish between crashes caused by the bug and crashes caused by a potential exploit. Which approach is most effective?

   • ATreat all crashes as potential exploits
   • BDisable the application until the bug is fixed
   • CBaseline the application's crash patterns, including the input that triggers the bug, and alert on crashes with different input patterns
   • DIgnore crashes that match the known bug
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A SIEM receives logs from a web application and an authentication system. An analyst notices that a user's login time is normal, but the application logs show a series of failed authorization attempts followed by a successful one that accessed an admin function. The user has never accessed admin functions before. Which correlation is most accurate?

   • AThe user is performing a new legitimate role
   • BThe application is malfunctioning
   • CThe SIEM is misconfigured
   • DThe user's account may be compromised, and the attacker is attempting privilege escalation
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which pattern in application logs is most indicative of a SQL injection attack?

   • AUnusual SQL query strings containing 'OR 1=1' or 'UNION SELECT'
   • BHigh CPU usage by the application server
   • CA user downloading a large file from the application
   • DRepeated failed login attempts from a single IP address
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary role of a SIEM platform in integrating application and user monitoring data?

   • ATo store all logs indefinitely without any analysis
   • BTo provide centralized analysis and alerting across multiple data sources
   • CTo replace the need for endpoint detection and response tools
   • DTo automatically patch vulnerabilities in applications
   Reveal Solution Discussion Select an answer first