A forensic analyst is reviewing a Windows workstation that was used to access sensitive HR files. The analyst notices that a scheduled task named 'SystemUpdate' runs PowerShell with an encoded command every hour, and the user's account shows a logon event at 3:00 AM from the same workstation. Which finding most strongly indicates malicious system activity rather than just user misbehavior?

The scheduled task runs PowerShell with an encoded command

The user accessed HR files during normal business hours

The scheduled task is named 'SystemUpdate'

The user logged on at 3:00 AM from the workstation

A forensic analyst is examining a compromised workstation. The security tool reports that a process named 'lsass.exe' has a child process 'cmd.exe'. The analyst knows that lsass.exe should not have children. What does this indicate?

An attacker is using a process injection technique to run commands in the context of lsass.exe

The system is experiencing a driver conflict

The user is running a troubleshooting tool

A legitimate Windows update is running

An analyst is investigating a possible data exfiltration. The logs show that a user copied files to a USB drive, then later used a cloud storage web app to upload the same files. Which combination of findings best indicates coordinated malicious user activity?

The user accessed the files from a personal device

The user copied files to USB and then uploaded them to cloud storage

The user received an email with a large attachment

The user logged in from a remote location

A forensic analyst is examining a Windows system and notices that a process named 'svchost.exe' is running from C:\Windows\Temp\, and the parent process is a user-level process. Which finding is the most reliable indicator of malicious system activity?

The process is named 'svchost.exe'

The process is running on a Windows system

The parent process is a user-level process

The process runs from C:\Windows\Temp\

An analyst is reviewing a user's activity after a suspected insider threat. The user accessed a file share containing financial records, then used a PowerShell command to compress files, and finally uploaded the archive to a personal cloud storage account. Which sequence of actions best indicates malicious user activity?

Accessing the financial records share

Using PowerShell to compress files

Accessing the share, compressing files, and uploading to personal cloud storage

Uploading to personal cloud storage

GIAC Certified Forensic Analyst

Domain 5Objective 2

Identification of Malicious System and User Activity GCFA Practice Questions (Page 5)

Part of the Activity Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

3concepts

Questions 21–25

21application · medium
A forensic analyst is reviewing a Windows workstation that was used to access sensitive HR files. The analyst notices that a scheduled task named 'SystemUpdate' runs PowerShell with an encoded command every hour, and the user's account shows a logon event at 3:00 AM from the same workstation. Which finding most strongly indicates malicious system activity rather than just user misbehavior?
Select an answer first
22application · medium
A forensic analyst is examining a compromised workstation. The security tool reports that a process named 'lsass.exe' has a child process 'cmd.exe'. The analyst knows that lsass.exe should not have children. What does this indicate?
Select an answer first
23application · medium
An analyst is investigating a possible data exfiltration. The logs show that a user copied files to a USB drive, then later used a cloud storage web app to upload the same files. Which combination of findings best indicates coordinated malicious user activity?
Select an answer first
24application · medium
A forensic analyst is examining a Windows system and notices that a process named 'svchost.exe' is running from C:\Windows\Temp\, and the parent process is a user-level process. Which finding is the most reliable indicator of malicious system activity?
Select an answer first
25application · medium
An analyst is reviewing a user's activity after a suspected insider threat. The user accessed a file share containing financial records, then used a PowerShell command to compress files, and finally uploaded the archive to a personal cloud storage account. Which sequence of actions best indicates malicious user activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Identification of Malicious System and User Activity GCFA Practice Questions (Page 5)

Questions 21–25

A forensic analyst is examining a compromised workstation. The security tool reports that a process named 'lsass.exe' has a child process 'cmd.exe'. The analyst knows that lsass.exe should not have children. What does this indicate?

An analyst is investigating a possible data exfiltration. The logs show that a user copied files to a USB drive, then later used a cloud storage web app to upload the same files. Which combination of findings best indicates coordinated malicious user activity?

A forensic analyst is examining a Windows system and notices that a process named 'svchost.exe' is running from C:\Windows\Temp\, and the parent process is a user-level process. Which finding is the most reliable indicator of malicious system activity?

Keep studying — Activity Analysis