Identification of Normal System and User Activity GCFA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the context of forensic activity analysis, what is the primary purpose of establishing a baseline for system activity?

   • ATo replace the need for collecting forensic evidence
   • BTo identify the exact time of a security incident
   • CTo provide a reference point for detecting deviations that may indicate malicious activity
   • DTo automatically block all unusual system behavior
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company's security team is creating a baseline for user activity on a fleet of laptops. They notice that some users frequently work remotely and log in from different geographic locations, while others only work from the office. Which approach should they take to establish an effective baseline for detecting anomalous logins?

   • ACreate individual baselines for each user, accounting for their typical login locations and times.
   • BOnly baseline users who work from the office, as remote users are too unpredictable.
   • CCreate a single company-wide baseline that includes all login locations and times.
   • DUse the same baseline for all users based on the office login pattern, since remote work is rare.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company has a policy that employees should only log in from company-owned devices. The analyst is reviewing authentication logs and notices that a user logged in from a device with a user-agent string that does not match any known corporate device. What should the analyst do?

   • AIgnore the login because the user entered the correct password.
   • BBlock the user's account immediately.
   • CAssume the user is using a new company device that was recently issued.
   • DFlag the login as potentially anomalous and investigate further.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A forensic analyst is establishing a baseline for a database server. The baseline should include normal query patterns and performance metrics. Which approach is most effective for detecting SQL injection attacks?

   • AMonitor only the server's CPU and memory usage to detect unusual activity.
   • BUse the database's default audit logs without additional configuration.
   • CRecord the typical SQL queries executed by the application and flag queries that deviate from the expected pattern.
   • DDisable all dynamic SQL queries to prevent injection attacks.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a typical indicator of normal user login behavior that would be captured in a baseline?

   • ALogins occurring at random times from multiple geographic locations
   • BLogins occurring only during business hours from the user's assigned workstation
   • CLogins occurring exclusively from a remote VPN IP address
   • DLogins occurring only after a password reset
   Reveal Solution Discussion Select an answer first