2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A user behavior alert indicates that an employee has been logging in from a new device and accessing the HR system, which is not part of their job role. The employee recently changed roles from marketing to operations, and the HR system access is consistent with the new role's responsibilities. What should the analyst do?

   • ADisable the employee's account because the HR system access is outside their previous role.
   • BBlock the new device from accessing the HR system.
   • CEscalate the alert to the incident response team for a full investigation.
   • DVerify the employee's new role and the device, then close the alert as a false positive.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A user behavior alert shows that an employee has been accessing a database containing customer credit card information outside of business hours. The organization is subject to PCI DSS and has a policy that requires immediate containment of any potential cardholder data breach. The employee's credentials have not been used from unusual locations. What should the analyst do?

   • AContact the employee to ask why they are accessing the database.
   • BIgnore the alert because the employee's credentials have not been used from unusual locations.
   • CDisable the employee's account and initiate an investigation into the database access.
   • DMonitor the employee's activity for a few more days to gather more context.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   Your SOC receives two user behavior alerts: (1) a junior employee accessed a file share containing financial reports at 2 AM, which is outside their normal hours, and (2) a senior executive accessed the same file share from a new device during business hours. The executive's role requires access to financial reports. You have limited staff. Which alert should you prioritize?

   • AThe executive's alert, because the new device is a higher risk.
   • BBoth alerts equally, because both involve access to financial reports.
   • CNeither alert, because both are likely false positives.
   • DThe junior employee's alert, because the time is anomalous and they may not have legitimate access.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security operations center receives two user behavior alerts. Alert 1: A user attempted to access a file containing credit card numbers without authorization. Alert 2: A user accessed a public website that is commonly used for personal browsing. Which alert should be prioritized for investigation?

   • AAlert 2, because personal browsing is a violation of company policy.
   • BNeither alert, because user behavior alerts are not reliable.
   • CAlert 1, because it involves a potential data breach and has higher severity and impact.
   • DBoth alerts equally, because both are user behavior alerts.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A user in the finance department who normally works 9 AM–5 PM from the office suddenly authenticates at 2 AM from a foreign IP address and downloads a 2 GB file from a file-sharing site. The user's account has no history of off-hours access or remote access. The organization has a policy that requires immediate containment for any account suspected of compromise. What should the security analyst do first?

   • ADisable the user's account and initiate an investigation into the authentication and download activity.
   • BIgnore the alert because the download is from a file-sharing site and may be legitimate personal use.
   • CAdd the foreign IP address to a blocklist and continue monitoring the user's activity without disabling the account.
   • DSend an email to the user asking if they were active at that time before taking any action.
   Reveal Solution Discussion Select an answer first