Identification of Normal System and User Activity GCFA Practice Questions (Page 8)

Questions 36–36

1. 36expert · hard

   An analyst is investigating a server that has been compromised. The baseline shows that the server typically runs a specific set of services and has a stable network connection profile. The analyst discovers that a new service has been installed and is configured to start automatically. The service is making outbound connections to a known malicious IP address. What is the most likely conclusion?

   • AThe service is malware that was installed as part of the compromise.
   • BThe service is a Windows system service that is running normally.
   • CThe service is a false positive and should be ignored.
   • DThe service is a legitimate application that was installed by an administrator.
   Reveal Solution Discussion Select an answer first