2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A user behavior alert flags that a system administrator has accessed a file share containing HR records. The administrator's role does not include HR data access, but they are part of an ongoing audit. What should you do?

   • ATreat the alert as a false positive because the administrator is part of an audit.
   • BContain the administrator's account immediately because they accessed HR data.
   • CVerify the access with the audit team and confirm the administrator's authorization.
   • DEscalate the alert to HR for disciplinary action.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A user behavior alert indicates that a user may have accessed protected health information (PHI) without authorization. The organization has a policy that requires reporting any potential PHI breach to the compliance officer. What is the next action the analyst should take?

   • AFollow the organizational incident response plan, which includes notifying the compliance officer and investigating the incident.
   • BImmediately delete the alert logs to avoid legal consequences.
   • CWait for the user to explain before taking any action.
   • DIgnore the alert because the user is an employee.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Your SOC receives two user behavior alerts: (1) a manager accessed 50 files in a shared drive, which is slightly above their normal 30-file daily average, and (2) a contractor downloaded 2 GB of data from a project repository at 3 AM, which is outside their normal working hours. Which alert should you prioritize?

   • AThe manager's alert, because they accessed more files than the contractor.
   • BBoth alerts equally, because both involve unusual file access.
   • CNeither alert, because user behavior alerts are typically false positives.
   • DThe contractor's alert, because the time and data volume deviate significantly from their baseline and indicate higher risk.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A user behavior alert indicates that a user is repeatedly failing authentication attempts on a critical application. The user is a known employee and the failures are occurring from the user's usual workstation. What is the most appropriate next action?

   • AEscalate the alert to the incident response team as a confirmed brute-force attack.
   • BIgnore the alert because the user is a known employee.
   • CImmediately block the user's account to prevent a brute-force attack.
   • DInvestigate the alert by checking the user's recent activity and contacting the user to verify if they are experiencing login issues.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A user behavior alert flags a help desk employee who has been resetting passwords for multiple executives in a short time period. The employee has never performed password resets for these executives before. The organization has a policy that requires verification of any unusual administrative action before taking further steps. What should the analyst do?

   • AReset the executives' passwords again to ensure they are secure.
   • BEscalate the alert to the incident response team for a full investigation.
   • CContact the help desk employee or their supervisor to verify whether the password resets were authorized.
   • DDisable the help desk employee's account immediately because the behavior is suspicious.
   Reveal Solution Discussion Select an answer first