Identification of Malicious System and User Activity GCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is reviewing a user's activity after a suspected breach. The logs show the user accessed a database, exported a large CSV file, and then emailed it to a personal address. Which action is the clearest indicator of malicious user activity?

   • AUsing a personal email account
   • BExporting a large CSV file
   • CEmailing the exported CSV to a personal address
   • DAccessing the database
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is examining a Linux server that appears to be running a cryptocurrency miner. The process list shows 'kworker' processes with high CPU usage, and the network connections show outbound connections to a known mining pool. Which additional finding would most strongly confirm malicious system activity?

   • AThe server has high CPU usage
   • BThe outbound connections use port 443
   • CThe 'kworker' processes are running from /tmp
   • DThe server has been running for 30 days
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic analyst is examining a Linux system. They find a process named 'kworker' that is writing to /tmp/.ICE-unix/... and making connections to an external IP. The analyst knows that kworker is a kernel thread and should not have network connections. What does this indicate?

   • AA rootkit is hiding a malicious process by using a kernel thread name
   • BThe system is under a distributed denial-of-service attack
   • CA kernel update is running
   • DA user is running a legitimate network tool
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A user's account shows a successful logon from a workstation that was decommissioned two weeks ago. The user is currently on vacation. The security team suspects credential theft. Which additional evidence would most strongly confirm malicious user activity?

   • AThe logon was followed by the creation of a new local admin account
   • BThe workstation's hard drive was wiped
   • CThe user's password was changed recently
   • DThe user's email was accessed from the same IP
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A user's account shows a successful logon at 2:00 AM from a foreign country, followed by a change to the user's password, and then access to a sensitive database. Which pattern of malicious user activity does this represent?

   • AInsider threat by the legitimate user
   • BDenial-of-service attack
   • CAccount takeover followed by privilege escalation and data access
   • DLateral movement from another system
   Reveal Solution Discussion Select an answer first