2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A user behavior alert shows that an employee has been logging in from multiple geographic locations within a short time period. The employee is not traveling. What is the most likely interpretation of this alert?

   • AThe employee's account may be compromised and used by an attacker.
   • BThe employee is using a VPN that routes through different locations.
   • CThe alert is a false positive because the user is not traveling.
   • DThe employee is using a mobile device that switches between networks.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A user in the finance department who normally works 9 AM to 5 PM has just authenticated to a file server at 2 AM from an IP address that is on the company's threat intelligence blocklist. The user has no history of remote access. Which action should you take first?

   • AEscalate the alert to law enforcement because the IP is blocklisted.
   • BAdd the user's account to a watch list and continue monitoring without any further action.
   • CDisable the user's account immediately and reset their password.
   • DVerify the alert against the user's baseline and the blocklist context before deciding on containment.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A user behavior alert flags a system administrator who has been logging in from a new VPN endpoint and running commands to disable security logging on multiple servers. The administrator has a history of performing maintenance during off-hours, but has never disabled security logging before. The organization has a policy that requires immediate containment for any activity that could disable security controls. However, the administrator is currently on-call and may be performing legitimate maintenance. What should the analyst do?

   • AContact the administrator to verify the maintenance activity before taking any action.
   • BMonitor the administrator's activity for a short period to see if the logging is re-enabled.
   • CDisable the administrator's account and initiate an investigation into the logging disablement.
   • DRe-enable the security logging on the affected servers and continue monitoring.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A user behavior alert indicates that an employee has been sending emails with attachments to a personal email address every Friday for a month. The attachments are small and the employee's role involves sharing reports with external partners. The organization's policy requires that any data sent to personal email addresses be investigated, but does not require automatic blocking. What is the most appropriate next action?

   • AAdd the personal email address to a blocklist and continue monitoring.
   • BIgnore the alert because the attachments are small and the behavior is consistent.
   • CImmediately block the employee's email account and escalate to HR.
   • DInvestigate the content of the attachments and the employee's job responsibilities to determine if the behavior is legitimate.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A security analyst reviews a user behavior alert indicating that a user account has downloaded 500 GB of data from a file share in the last hour, while the user's historical baseline shows an average of 2 GB per day. What is the most appropriate first step for the analyst to take?

   • AIgnore the alert because the user has legitimate access to the file share.
   • BEscalate the alert to law enforcement immediately.
   • CImmediately disable the user account to prevent further data exfiltration.
   • DInvestigate the alert by checking the context, such as the user's role, recent activity, and whether the download was authorized.
   Reveal Solution Discussion Select an answer first