Endpoint Analytics GCDA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which endpoint data source would provide the most direct evidence of a persistence mechanism that runs a program each time the system starts?

   • AMemory dump contents
   • BAuthentication logs
   • CRegistry key modifications
   • DFile system creation timestamps
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst notices that a user account that normally logs in during business hours from a specific workstation has just logged in at 3:00 AM from a different workstation. The analyst wants to create a detection that flags this type of activity. Which endpoint data source and analytical technique would be most effective?

   • AFile system logs with a baseline of file access patterns
   • BAuthentication logs with a baseline of normal login times and locations
   • CRegistry event logs with a baseline of registry modifications
   • DProcess creation logs with a baseline of running processes
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A detection engineer wants to identify anomalous PowerShell usage on a fleet of servers. The team has three months of historical logs. Which analytical approach is most appropriate to establish a baseline for each server?

   • ACorrelate PowerShell executions with successful logons and flag all correlated events
   • BCompute the average number of PowerShell executions per server per day and flag days exceeding three standard deviations
   • CFlag any PowerShell execution that occurs outside business hours
   • DUse a single global threshold for all servers based on the fleet-wide average
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of an endpoint data source that records the execution of commands and applications on a host?

   • AProcess execution logs
   • BNetwork flow records
   • CFirewall allow/deny logs
   • DDNS query logs
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is using an anomaly detection model that flags unusual process execution patterns on endpoints. The model is generating false positives for developers who compile code frequently. The developers' build processes spawn many child processes and write to temp directories. The team wants to reduce false positives without missing real malware. Which approach is most appropriate?

   • ADisable the model for developer endpoints
   • BIncrease the anomaly threshold for all endpoints
   • CReduce the time window for the anomaly model
   • DCreate a separate baseline for developer endpoints and exclude known build tools from the anomaly model
   Reveal Solution Discussion Select an answer first