An analyst wants to detect a user account that is logging into multiple workstations in a short time, which could indicate credential theft. Which analytical method is most appropriate?

Signature matching on logon type codes

Anomaly detection on logon time of day

Baseline the number of logons per user per day and flag deviations

Correlate authentication events across multiple hosts for the same user within a time window

An analyst is investigating a potential malware infection on a Linux server. The analyst suspects that the malware modified a system binary and created a hidden process. The server does not have an EDR agent installed, but it does have auditd, syslog, and file integrity monitoring (FIM) configured. Which combination of data sources would provide the best evidence of the binary modification and hidden process?

FIM logs for the binary modification and auditd logs for process creation

Auditd logs for the binary modification and syslog for process creation

FIM logs for both the binary modification and process creation

Syslog for the binary modification and FIM logs for process creation

A security team wants to collect endpoint telemetry from remote laptops that are often offline and connect through VPN intermittently. They need reliable data delivery without losing events when a laptop is disconnected. Which collection method is most appropriate?

Send logs only when the laptop is connected to the corporate network via Ethernet

Use an endpoint agent that queues events locally and forwards them when connectivity is available

Configure the VPN to mirror all traffic to the SIEM in real time

Use Windows Event Forwarding with a pull model from the central collector

An analyst is investigating a potential privilege escalation on a Windows endpoint. The analyst suspects that a standard user ran a process that temporarily granted administrative privileges. Which endpoint data source is most likely to provide the evidence needed to confirm this?

Security event logs that record token manipulation and privilege use

GIAC Certified Detection Analyst

Domain 4Objective 1

Endpoint Analytics GCDA Practice Questions (Page 4)

Part of the Endpoint and User Analytics domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 16–20

16application · medium
An analyst wants to detect a user account that is logging into multiple workstations in a short time, which could indicate credential theft. Which analytical method is most appropriate?
Select an answer first
17expert · hard
An analyst is investigating a potential malware infection on a Linux server. The analyst suspects that the malware modified a system binary and created a hidden process. The server does not have an EDR agent installed, but it does have auditd, syslog, and file integrity monitoring (FIM) configured. Which combination of data sources would provide the best evidence of the binary modification and hidden process?
Select an answer first
18application · medium
A security team wants to collect endpoint telemetry from remote laptops that are often offline and connect through VPN intermittently. They need reliable data delivery without losing events when a laptop is disconnected. Which collection method is most appropriate?
Select an answer first
19application · medium
An analyst is investigating a potential privilege escalation on a Windows endpoint. The analyst suspects that a standard user ran a process that temporarily granted administrative privileges. Which endpoint data source is most likely to provide the evidence needed to confirm this?
Select an answer first
20foundation · easy
Which endpoint detection scenario is most directly indicated by a user account successfully authenticating to multiple workstations within a short time period?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Endpoint Analytics GCDA Practice Questions (Page 4)

Questions 16–20

An analyst wants to detect a user account that is logging into multiple workstations in a short time, which could indicate credential theft. Which analytical method is most appropriate?

A security team wants to collect endpoint telemetry from remote laptops that are often offline and connect through VPN intermittently. They need reliable data delivery without losing events when a laptop is disconnected. Which collection method is most appropriate?

An analyst is investigating a potential privilege escalation on a Windows endpoint. The analyst suspects that a standard user ran a process that temporarily granted administrative privileges. Which endpoint data source is most likely to provide the evidence needed to confirm this?

Which endpoint detection scenario is most directly indicated by a user account successfully authenticating to multiple workstations within a short time period?

Keep studying — Endpoint and User Analytics