Identification of Malicious System and User Activity GCFA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An analyst is investigating a potential data breach. The following events were found: (1) a user account 'mwilson' logged on to a file server at 3 AM, (2) the user's workstation had a keylogger installed, (3) at 3:15 AM, a process named 'powershell.exe' was used to download a file from a file-sharing site, (4) the file server logs show that 'mwilson' accessed a folder containing HR records and copied files to a USB drive. Which conclusion is most defensible?

   • AA malware infection caused the file server to copy data to USB
   • BAn attacker used keylogging to steal 'mwilson's credentials and exfiltrate HR data
   • CThe user 'mwilson' is a disgruntled employee stealing data
   • DThe events are unrelated and coincidental
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An analyst is investigating a user account that was used to log into a server at 2 AM. The user denies any activity. The server logs show that the account was used to run 'regedit.exe' and modify the 'Run' registry key. What does this indicate?

   • AAn attacker was establishing persistence
   • BA system administrator was performing maintenance
   • CThe user was installing software
   • DThe user was cleaning up their startup programs
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An analyst is investigating a series of events on a network. The following were observed: (1) a user account 'tlee' logged into a workstation at 1 AM, (2) the workstation's process logs show that 'powershell.exe' was used to download a tool from a file-sharing site, (3) the tool was used to dump credentials from memory, (4) the credentials were then used to log into a domain controller. Which conclusion is most defensible?

   • AThe user 'tlee' was performing a security assessment
   • BAn attacker used 'tlee's account to move laterally and compromise the domain
   • CThe events are unrelated
   • DA malware infection caused the credential dump
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An incident responder is correlating events from a compromised web server. The web server logs show a SQL injection attempt at 3:00 PM, and at 3:05 PM a new user account 'support' was created with admin privileges. At 3:10 PM, the 'support' account was used to upload a web shell. Which attack pattern is best supported?

   • AThe web shell was uploaded by a legitimate administrator
   • BThe SQL injection was a false positive and the account creation was routine
   • CSQL injection led to privilege escalation and web shell upload
   • DThe attack was a brute-force attack on the admin account
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During an incident response, you find that a standard user account recently executed 'whoami /priv' and 'net localgroup administrators' in quick succession, followed by a failed attempt to run 'psexec -s cmd.exe'. The account's logon session originated from a workstation that had been infected with a keylogger. What does this sequence most likely indicate?

   • AA scheduled task ran a maintenance script
   • BThe user was troubleshooting their own permissions
   • CAn attacker was performing reconnaissance for privilege escalation
   • DThe user was attempting to install legitimate software
   Reveal Solution Discussion Select an answer first