Identification of Normal System and User Activity GCFA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst is reviewing authentication logs for a company that uses a badge-swipe system for physical access and Active Directory for logical access. The baseline shows that employees typically swipe into the building between 8:00 and 9:00 AM and log into their workstations within 10 minutes. One morning, an employee's badge is used at 7:00 AM, but their workstation login occurs at 9:30 AM. What does this deviation suggest?

   • AThe employee must have used a different workstation, which explains the delay.
   • BThe employee simply forgot to log in immediately and this is not worth investigating.
   • CThe employee may have arrived early and performed an activity before logging into the workstation, which is worth correlating with other logs.
   • DThe badge system and Active Directory are not synchronized, so the times are unreliable.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to establish a baseline for user activity on its email system. Which data source would provide the most useful information for identifying normal user behavior?

   • ADNS logs showing queries to external domains.
   • BFirewall logs showing all outbound traffic from the organization.
   • CEmail server logs showing login times, send/receive volumes, and client types.
   • DAntivirus logs showing malware detections on user workstations.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A forensic analyst is investigating a potential data breach. The company has a policy that employees should not use personal cloud storage for work files. The analyst has established a baseline that shows no employees accessing personal cloud storage sites. During the investigation, the analyst finds that a user accessed a personal cloud storage site from their workstation during business hours. The user claims they were uploading personal photos. What is the most likely conclusion?

   • AThe user's account is compromised by an external attacker.
   • BThe user may be violating company policy, but it is not necessarily a data breach.
   • CThe user is definitely exfiltrating company data.
   • DThe user is performing legitimate work-related tasks.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A forensic analyst is reviewing user activity logs for a company that has a high turnover rate. The baseline shows that employees typically access a set of internal applications and rarely use external cloud storage. The analyst notices that a departing employee's account is accessing external cloud storage and downloading large files during their final week. What is the most appropriate action?

   • AUpdate the baseline to include cloud storage usage because employees may need it.
   • BInvestigate the activity as a potential data exfiltration, while considering the employee's legitimate need to transfer files.
   • CIgnore the activity because the employee is still employed and has legitimate access.
   • DImmediately revoke the employee's access to prevent data loss.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic analyst is establishing a baseline for a Windows file server that hosts the company's financial documents. The server has been in production for six months. To identify a baseline for normal system activity, which approach is most appropriate?

   • ACollect performance counters, running processes, and network connections over a two-week period during normal business operations.
   • BCapture a snapshot of all running processes and open ports at a single point in time.
   • CUse the vendor's default performance recommendations as the baseline for the server.
   • DReview the server's event logs from the last 24 hours to establish what is currently running.
   Reveal Solution Discussion Select an answer first