Identification of Malicious System and User Activity GCFA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An analyst is correlating events from a web server and a database server. The web server logs show a series of SQL injection attempts from a specific IP, and the database server logs show a successful login from the same IP using a service account. The database logs also show a query that exports a large amount of data to a file. Which conclusion is most supported?

   • AThe SQL injection attempts were unsuccessful and the database login was a coincidence
   • BThe attacker used SQL injection to gain access to the web server and then used stolen credentials to access the database
   • CThe database service account was compromised by malware
   • DThe data export was a legitimate backup process
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During an incident response, an analyst finds that a user's account was used to RDP into a server at 2:00 AM, and at the same time a process on that server spawned a child process that made an outbound connection to an IP address known for C2. The user claims they were asleep. Which conclusion is most defensible?

   • AThe user is lying and performed the actions themselves
   • BThe server was already compromised before the RDP session
   • CThe RDP session was legitimate, and the C2 connection is unrelated
   • DThe user's account was likely compromised, and the RDP session was used to launch the C2 connection
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic team is investigating a breach. System logs show a new service 'svchost_net' running from a non-standard path, and user logs show the 'admin' account was used to create a new local user 'backup' at the same time. The 'backup' user has no logon activity. Which conclusion is best supported by correlating these findings?

   • AThe 'backup' user was created as a persistence mechanism by an attacker who compromised the 'admin' account
   • BThe 'backup' user is a legitimate account created by IT for backup purposes
   • CThe 'admin' account was compromised, but the 'backup' user is a decoy
   • DThe 'svchost_net' service is a false positive and the 'backup' user is unrelated
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An analyst correlates a user's login time with a system event showing that a process was launched from a suspicious path immediately after the login. What does this correlation most directly reveal?

   • AA privilege escalation attempt
   • BA coordinated attack where the user login triggered the malicious process
   • CA normal user session with no malicious activity
   • DA false positive in the system logs
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A user reports that their account has been locked out. The security logs show multiple failed logon attempts from various IP addresses over the past hour, followed by a successful logon from an IP in a foreign country. The user is currently at their desk and has not traveled. Which action should the analyst take first?

   • AAsk the user if they used a VPN
   • BReset the user's password and enable multi-factor authentication
   • CDisable the user account and begin forensic collection
   • DIgnore the foreign IP because the user is at their desk
   Reveal Solution Discussion Select an answer first