Identification of Normal System and User Activity GCFA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is establishing a baseline for a new server that will host a public-facing web application. The team has no historical data for this server. Which approach is most effective for establishing a baseline that will be useful for anomaly detection?

   • AWait until the server is in production for a month before establishing a baseline.
   • BUse the baseline from a similar existing server in the company.
   • CDeploy the server in a staging environment, simulate expected traffic, and record the resulting process and network behavior.
   • DDeploy the server directly to production and collect data for a week, then use that as the baseline.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An analyst is establishing a baseline for a database server that supports a customer-facing application. The server experiences high CPU usage during business hours and low usage at night. The analyst needs to identify anomalies without generating excessive false positives. Which approach is most effective?

   • AAlert only when CPU usage is above 90% for more than 30 minutes.
   • BCompare current CPU usage to the average usage over the past 24 hours.
   • CSet a fixed CPU threshold of 80% and alert whenever it is exceeded.
   • DUse statistical analysis to establish thresholds based on historical data, accounting for time-of-day and day-of-week variations.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An analyst is reviewing authentication logs for a company that uses multi-factor authentication (MFA). The baseline shows that users typically authenticate from the office network during business hours. The analyst notices that a user authenticated successfully from a coffee shop IP address at 3 PM, and the MFA prompt was approved. What is the most likely explanation?

   • AThe user may be working remotely, and the MFA approval indicates legitimate access.
   • BThe user's account is compromised because the login is from a coffee shop.
   • CThe MFA prompt was approved by an attacker who intercepted the request.
   • DThe user is using a VPN that routes through a coffee shop IP address.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic analyst is establishing a baseline for a database server that runs critical applications. The baseline should include process lists, network connections, and performance metrics. Which additional data source would be most valuable for detecting anomalies related to unauthorized access?

   • ADNS logs that record domain name resolution requests.
   • BApplication logs that record database queries and transactions.
   • CFile system audit logs that record changes to files and directories.
   • DAuthentication logs that record successful and failed login attempts.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A forensic analyst is reviewing a user's activity on a corporate workstation. The baseline shows that the user typically works from 9 AM to 5 PM, accesses the accounting software, and uses email. The analyst notices that the user logged in at 2 AM and ran a PowerShell script that compressed and encrypted several files. What is the most likely explanation?

   • AThe user is working overtime to meet a deadline.
   • BThe user is testing a new backup procedure.
   • CThe user's account may be compromised, and the activity could be data exfiltration.
   • DThe user is performing routine maintenance on their workstation.
   Reveal Solution Discussion Select an answer first