Identification of Normal System and User Activity GCFA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In forensic analysis, what is the primary method for recognizing an anomaly in system or user activity?

   • AInspecting the physical security of the server room
   • BComparing observed activity against an established baseline
   • CReviewing the system's uptime and patch history
   • DChecking the user's account lockout status
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is reviewing user activity logs for a department that uses a shared file server. The baseline shows that users typically access files during business hours and rarely access files outside of that time. The analyst notices that a user accessed a large number of files at 1 AM. What should the analyst do first?

   • AReport the activity to law enforcement.
   • BIgnore the activity because it is just one instance.
   • CInvestigate the activity to determine if it is legitimate.
   • DDisable the user's account.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic analyst is building a baseline for a web server. The baseline includes CPU usage, memory usage, and network connections. The analyst notices that the server's CPU usage spikes to 100% every night at 2:00 AM for 30 minutes. Which action is most appropriate?

   • AIncrease the server's resources to handle the spike.
   • BInvestigate the cause of the nightly spike to determine if it is a scheduled task or malicious activity.
   • CDisable all scheduled tasks to prevent the spike.
   • DIgnore it because it is consistent and therefore normal.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A forensic analyst is reviewing user activity for a company that has employees in multiple time zones. The analyst has established that each user typically logs in during their local business hours. The analyst notices that a user based in New York (UTC-5) has been logging in at 2:00 AM UTC, which is 9:00 PM EST. The user's role does not require after-hours work. What is the most likely explanation?

   • AThe user's account may be compromised, and the login is from a different time zone.
   • BThe user is traveling and logging in from a different time zone.
   • CThe user is using a VPN that changes their apparent time zone.
   • DThe user is working overtime to meet a deadline.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic analyst is reviewing a Windows workstation's event logs. The baseline shows that the user typically logs in at 8:00 AM and uses Microsoft Office applications. The analyst finds that the user's account logged in at 3:00 AM and ran PowerShell commands. What is the most appropriate conclusion?

   • AThe account may be compromised, and the analyst should investigate the PowerShell commands and the source of the login.
   • BThe login was likely a scheduled task that ran under the user's account.
   • CThe user is likely performing legitimate system administration tasks.
   • DThe activity is normal because PowerShell is a standard Windows tool.
   Reveal Solution Discussion Select an answer first