Identification of Normal System and User Activity GCFA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following data sources is most commonly used to establish a baseline of normal network connections for a host?

   • ANetFlow or connection logs from the host's firewall
   • BThe host's registry keys for installed software
   • CThe host's event log for application errors
   • DThe host's file system timestamps for user documents
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A forensic analyst is establishing a baseline for a critical production server. The server runs a batch processing job every night that consumes significant CPU and memory. The analyst needs to distinguish between normal batch processing and potential malicious activity. Which approach is most effective?

   • ARecord the specific processes, their command lines, and the network connections associated with the batch job during a known-good period.
   • BDisable the batch job temporarily to establish a baseline without it.
   • CUse the server's default performance counters without additional logging.
   • DOnly record CPU and memory usage during the batch job to establish a performance baseline.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic analyst is reviewing a Windows server's event logs. The baseline shows that the server typically has 10–15 interactive logons per day, all from the IT admin team. The analyst finds 50 interactive logons in one day, all from the same user account, with many occurring at odd hours. What is the most likely explanation?

   • AThe user's password expired, forcing them to log in multiple times.
   • BThe server was rebooted multiple times, generating logon events.
   • CThe user account may be compromised, and the analyst should investigate the source of the logons.
   • DThe user was performing routine maintenance that required multiple logons.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What does a baseline of normal user activity typically include?

   • AThe user's group memberships and security clearance level
   • BThe user's password hash and account creation date
   • CThe user's typical login times, workstations, and frequently used applications
   • DThe user's email signature and display name
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is establishing a baseline for a database server that runs critical applications. The server experiences peak usage during business hours and low usage at night. Which approach would best capture the normal performance baseline?

   • ACollect performance data only during peak usage hours.
   • BCollect performance data only during business hours for one day.
   • CCollect performance data over a full week, including weekends, at 15-minute intervals.
   • DCollect performance data once per day at a random time.
   Reveal Solution Discussion Select an answer first