GCFA Practice Question: Identification of Malicious and Normal Activity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The account is locked out and requires administrative intervention to unlock.

  Why it's wrong here

  Event ID 4625 indicates failed logon attempts, but account lockout is typically recorded with Event ID 4740. The presence of a subsequent successful logon (4624) indicates the account was not locked out at that time, so lockout is not the explanation.

• ✗

  The system is experiencing a denial-of-service attack due to excessive failed logons.

  Why it's wrong here

  A denial-of-service attack would typically involve a high volume of failed logons from many accounts or sources, potentially causing account lockouts or system slowdowns. A few failed attempts followed by a success for a single user do not suggest a DoS condition.

• ✗

  An attacker has successfully brute-forced the user's password after multiple attempts.

  Why it's wrong here

  While brute-force attacks involve multiple failed attempts followed by a success, this pattern is more indicative of a user error unless there is a high number of attempts or other signs like unusual source IP addresses. A few attempts are common in normal usage.

• ✓

  The user mistyped their password several times before successfully logging in.

  Why this is correct

  Multiple failed logon attempts followed by a successful logon for the same account often indicate a user who forgot their password or made typographical errors. While this could also indicate a brute-force attack, the pattern alone without other indicators (like many different accounts or high volume) is most consistent with normal user error.