Identification of Malicious System and User Activity GCFA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A forensic team is investigating a server that was used to pivot into the network. They find that a user 'alice' logged on via SSH from an external IP, and shortly after, a process running as 'alice' executed a command that created a reverse shell to another internal server. Which correlation best explains the attack?

   • AThe reverse shell was created by a legitimate process
   • BThe external SSH logon was the initial access, and the reverse shell was used for lateral movement
   • CThe external IP is a false positive and the attack originated internally
   • DThe attack was a denial-of-service, not a compromise
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   During a forensic review of a compromised Windows workstation, an analyst observes a process named 'svchost.exe' running from the user's temporary folder. Which indicator of malicious system activity does this observation most directly represent?

   • AAn unusual process execution path
   • BAn unexpected system call sequence
   • CA legitimate Windows service running normally
   • DAn abnormal network connection to a foreign IP
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a forensic review of authentication logs, an analyst finds that a standard user account successfully logged in at 3:00 AM, and shortly after, the account was added to the local Administrators group. Which malicious user activity does this sequence most directly indicate?

   • AData exfiltration
   • BBrute-force attack
   • CPrivilege escalation
   • DUnauthorized access
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is reviewing a user's activity logs. The user 'jdoe' normally works from 9 AM to 5 PM. The logs show that 'jdoe' logged in at 2 AM, accessed a database containing customer PII, and then used a file compression tool to create a ZIP file. The user's workstation was physically secured overnight. What is the most likely explanation?

   • AAn attacker used stolen credentials to access and exfiltrate data
   • BThe user worked overtime and backed up data
   • CThe user's account was used by IT for maintenance
   • DA scheduled job ran under the user's account
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is correlating events from a compromised server. The server's process logs show that 'svchost.exe' spawned 'powershell.exe' with a download cradle. The user activity logs show that a user account 'bjackson' was logged on at the time. The user's workstation was found to have a malicious macro-enabled document. Which conclusion is most defensible?

   • AThe attacker used the malicious document to gain access to the server via 'bjackson's session
   • BThe server's svchost.exe was compromised by a separate attack
   • CThe events are unrelated
   • DThe user 'bjackson' ran the PowerShell command manually
   Reveal Solution Discussion Select an answer first