Identification of Normal System and User Activity GCFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is establishing a baseline for user activity on a shared file server. The baseline shows that most users access files during business hours and use specific applications. One user, an accountant, typically accesses Excel files and PDFs. The analyst observes the accountant's account accessing a large number of executable files at 3:00 AM. What should the analyst do?

   • AUpdate the baseline to include late-night activity because it happened once.
   • BTreat this as an anomaly and investigate the account for potential compromise.
   • CAssume the user's account was used by another employee and take no action.
   • DIgnore it because the user may have had a legitimate reason to work late.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is reviewing user activity logs for a company that uses a VPN for remote access. The baseline shows that users typically connect from a specific set of IP addresses and use the VPN during business hours. The analyst notices a user connecting from a new IP address at 11:00 PM. What is the most appropriate next step?

   • AVerify whether the user is traveling or has a legitimate reason to connect from a new IP address.
   • BReset the user's password because the account is likely compromised.
   • CImmediately block the user's VPN access because the IP address is unknown.
   • DIgnore the event because VPN users can connect from anywhere.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic analyst is examining a Windows server that runs a custom application. The baseline shows that the application typically makes 10–15 outbound connections to a specific database server on port 1433. During an investigation, the analyst finds the application making connections to a new IP address on port 1433, and the process name is the same. What is the most likely explanation?

   • AThe application's configuration may have been changed to point to a different database server, which could be malicious or accidental.
   • BThe database server was moved to a new IP address, and the application was updated to reflect this.
   • CThe server is infected with malware that is mimicking the application's network behavior.
   • DThe application is using a different port for load balancing.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is establishing a baseline for a server that runs a critical application. The server has been in production for a year, and the analyst has collected performance data for the past month. The analyst notices that the server's CPU usage has been gradually increasing over the past week, but it is still within the normal range. What should the analyst do?

   • AIgnore the increase because it is within the normal range.
   • BImmediately shut down the server to prevent a crash.
   • CUpdate the baseline to reflect the new CPU usage.
   • DInvestigate the gradual increase to determine if it indicates a developing issue.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic analyst is examining a Linux server that runs a web application. The baseline shows that the server typically has 20–30 established outbound connections to database servers on port 5432, and CPU usage averages 20–30%. During an investigation, the analyst observes 150 outbound connections to an IP address on port 4444 and CPU usage at 95%. What is the most appropriate initial conclusion?

   • AThe server has a misconfigured application that is causing excessive database connections.
   • BThe server is experiencing a normal traffic spike due to increased user demand.
   • CThe server is running a scheduled backup that requires many outbound connections.
   • DThe server is likely compromised, and the analyst should capture memory and network traffic for further analysis.
   Reveal Solution Discussion Select an answer first