Identification of Malicious System and User Activity GCFA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A forensic analyst is investigating a Windows workstation where a user reported slow performance. The analyst finds a process named 'svch0st.exe' running from C:\Users\Public\ with an open TCP connection to an external IP on port 4444. The user's account shows a successful logon at 3:00 AM, but the user denies being awake. Which combination of findings most strongly indicates coordinated malicious system and user activity?

   • AThe slow performance and the external IP address on port 4444
   • BThe process name masquerading as a legitimate service, the unusual file path, and the off-hours logon
   • CThe open TCP connection and the user's denial of being awake
   • DThe file path C:\Users\Public\ and the successful logon at 3:00 AM
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A forensic analyst is correlating events from a compromised file server. The following were captured: (1) a user account 'jsmith' authenticated via RDP from an external IP at 02:00, (2) at 02:05, a process named 'winword.exe' spawned 'powershell.exe' with an encoded command, (3) at 02:10, the account 'jsmith' accessed a folder containing financial spreadsheets and copied files to a network share. The analyst must determine whether this is a coordinated attack or separate incidents. Which additional piece of evidence would most strongly support a coordinated attack?

   • AThe external IP is a known Tor exit node
   • BThe powershell.exe process was launched from the same logon session as the RDP session
   • CThe file server had a misconfigured firewall allowing RDP from the internet
   • DThe financial spreadsheets were recently modified by another user
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is reviewing authentication logs and sees that a standard user account 'jsmith' was added to the local Administrators group, and then a new scheduled task was created that runs a script to disable security software. Which user activity pattern does this represent?

   • APrivilege escalation followed by defense evasion
   • BLateral movement to another workstation
   • CPersistence through a new user account
   • DData exfiltration through scheduled tasks
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A forensic analyst is investigating a Windows system where the user reports unusual behavior. The analyst finds a process named 'lsass.exe' running from C:\Users\Public\, and the same user account has recently been granted SeDebugPrivilege. Which finding is the strongest indicator of malicious activity?

   • AThe process 'lsass.exe' is running from C:\Users\Public\
   • BThe process is named 'lsass.exe'
   • CThe user account has SeDebugPrivilege
   • DThe user reports unusual behavior
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   An analyst is reviewing a Linux system's audit logs and notices a process making repeated 'connect()' system calls to the same external IP address on port 4444. Which type of malicious system activity does this pattern most likely indicate?

   • AA data exfiltration via DNS queries
   • BA local privilege escalation attempt
   • CA reverse shell or command-and-control beacon
   • DA normal software update check
   Reveal Solution Discussion Select an answer first