2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A user behavior alert indicates that an employee has been accessing a competitor's website from their corporate device during work hours. The employee's role is in research and development. What is the most appropriate next action?

   • AEscalate the alert to legal for potential corporate espionage.
   • BInvestigate the context of the access, such as whether the employee is researching for a project.
   • CBlock the employee's internet access immediately.
   • DIgnore the alert because competitor research is common in R&D.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   Your organization has a policy that any user behavior alert involving a privileged account must be escalated to the incident response team within 15 minutes. A privileged user's account triggers an alert for an unusual login time. You have verified that the user is on-call and the login is legitimate. What should you do?

   • AEscalate the alert to the incident response team as required by policy.
   • BClose the alert without escalation because you have verified it is legitimate.
   • CWait for additional alerts before escalating.
   • DDisable the privileged account until the incident response team reviews the alert.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   Your SOC has limited staff and receives two user behavior alerts: (1) a user accessed a sensitive file from a known malicious IP address, and (2) a user attempted to access a restricted server but failed due to permissions. Which alert should you investigate first?

   • AThe successful access from a malicious IP, because it indicates a likely compromise and higher impact.
   • BBoth alerts simultaneously, because both are equally important.
   • CNeither alert, because user behavior alerts are often false positives.
   • DThe failed access attempt, because it indicates a potential insider threat.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A user behavior alert flags that an employee has been accessing a customer database from a new IP address. The employee is in customer support and has legitimate access to the database. The new IP address is in a different country. The employee is not traveling. What should you do?

   • AInvestigate the IP address and verify with the employee before taking any action.
   • BContain the employee's access immediately because the IP is in a different country.
   • CEscalate the alert to the incident response team because of the foreign IP.
   • DIgnore the alert because the employee has legitimate access.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A user behavior alert indicates that a finance employee has been accessing the HR payroll database every night for the past week, which is outside their normal job function. The employee's credentials have not been used from unusual locations, and there is no other suspicious activity. The organization's policy requires that any access to sensitive data outside job duties be immediately investigated, but does not require automatic account suspension. What is the most appropriate next action?

   • ASend a warning email to the employee and close the alert.
   • BReset the employee's password and require multi-factor authentication enrollment.
   • CImmediately disable the employee's account and escalate to law enforcement.
   • DLaunch an investigation to determine the reason for the access, including interviewing the employee's manager.
   Reveal Solution Discussion Select an answer first