Identification of Normal System and User Activity GCFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A forensic analyst is investigating a potential insider threat. The company has a 24/7 operations team, and the analyst has established baselines for both system and user activity. The analyst notices that a user who works the night shift (11 PM–7 AM) has been logging in during the day shift (9 AM–5 PM) for the past three days. The user's job role does not require cross-shift work. Additionally, the user's workstation has been making outbound connections to a file-sharing website during these daytime logins. What is the most likely conclusion?

   • AThe user is covering a colleague's shift.
   • BThe user's account has been compromised by an external attacker.
   • CThe user is performing legitimate work from home.
   • DThe user is engaged in unauthorized activity, possibly exfiltrating data.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is establishing a baseline for a Windows file server that hosts shared documents. They plan to monitor process creation, network connections, and performance counters. Which approach best establishes a meaningful baseline for detecting anomalies?

   • ACollect data only during business hours on weekdays to avoid weekend noise.
   • BUse the default Windows performance counters without additional logging, as they provide a complete baseline.
   • CCollect data for a full week, including weekends, and record the normal range of processes, connections, and CPU/memory usage.
   • DCollect data for one day and extrapolate it to the whole month to save storage.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic analyst is reviewing a Windows 10 workstation's event logs and process creation data after a suspected malware infection. The user is a graphic designer who works 9 AM to 5 PM. The analyst notices a process named 'svchost.exe' spawning 'cmd.exe' at 2:15 AM, and the user's account logged in at 2:14 AM. The analyst checks the baseline and finds that the user never logs in outside work hours. Which conclusion is most justified?

   • AThe activity is normal because Windows updates often run svchost.exe and cmd.exe during off-hours.
   • BThe activity is normal because the user logged in, so any process they run is considered user activity.
   • CThe activity is normal because svchost.exe is a legitimate Windows process and cmd.exe can be used for system maintenance.
   • DThe 2:14 AM login and process activity are anomalous and warrant further investigation.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic analyst is investigating a potential intrusion on a web server. The baseline shows that the server typically maintains 50–80 outbound connections, mostly to update repositories and monitoring services. During the investigation, the analyst observes 500 outbound connections to a single IP address on port 443. What does this indicate?

   • AThe server is experiencing a denial-of-service attack from external sources.
   • BThe server is running a legitimate backup process to an offsite location.
   • CThe server may be part of a botnet or exfiltrating data to a command-and-control server.
   • DThe server is likely performing routine updates from a new repository.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic analyst is establishing a baseline for a Linux server that runs a web application. The baseline should include process activity, network connections, and system performance. Which tool or method is most appropriate for collecting this data?

   • AConfigure auditd to log process executions and use netstat to capture network connections at regular intervals.
   • BUse only the top command to monitor CPU and memory usage.
   • CUse a packet capture tool like tcpdump to record all network traffic continuously.
   • DUse the system's default syslog without additional configuration.
   Reveal Solution Discussion Select an answer first